theory Untyped_R

lemma decodeUntypedInvocation_corres:
  assumes cap_rel: "list_all2 cap_relation cs cs'"
  shows "corres
        (ser \<oplus> untypinv_relation)
        (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x \<in> set cs. s \<turnstile> x))
        (invs'
          and (\<lambda>s. \<forall>x \<in> set cs'. s \<turnstile>' x))
        (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs)
        (decodeUntypedInvocation label args (cte_map slot)
          (UntypedCap d w n idx) cs')" proof (cases "6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype") case False show ?thesis using False cap_rel apply (clarsimp simp: decode_untyped_invocation_def
                          decodeUntypedInvocation_def
                          whenE_whenE_body unlessE_whenE
               split del: if_split cong: list.case_cong) apply (auto split: list.split) done next case True have val_le_length_Cons: (* clagged from Tcb_R *)
    "\<And>n xs. n \<noteq> 0 \<Longrightarrow> (n \<le> length xs) = (\<exists>y ys. xs = y # ys \<and> (n - 1) \<le> length ys)" apply (case_tac xs, simp_all) apply (case_tac n, simp_all) done obtain arg0 arg1 arg2 arg3 arg4 arg5 argsmore cap cap' csmore csmore'
    where args: "args = arg0 # arg1 # arg2 # arg3 # arg4 # arg5 # argsmore"
      and   cs: "cs = cap # csmore"
      and  cs': "cs' = cap' # csmore'"
      and crel: "cap_relation cap cap'" using True cap_rel by (clarsimp simp: neq_Nil_conv list_all2_Cons1 val_le_length_Cons) have il: "gen_invocation_type label = UntypedRetype" using True by simp have word_unat_power2:
    "\<And>bits. \<lbrakk> bits < 32 \<or> bits < word_bits \<rbrakk> \<Longrightarrow> unat (2 ^ bits :: word32) = 2 ^ bits" by (simp add: word_bits_def) have P: "\<And>P. corres (ser \<oplus> dc) \<top> \<top>
                  (whenE P (throwError ExceptionTypes_A.syscall_error.TruncatedMessage))
                  (whenE P (throwError Fault_H.syscall_error.TruncatedMessage))" by (simp add: whenE_def returnOk_def) have Q: "\<And>v. corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum (unat v))) = a)) \<top> \<top>
                  (data_to_obj_type v)
                  (whenE (fromEnum (maxBound :: ARM_H.object_type) < unat v)
                       (throwError (Fault_H.syscall_error.InvalidArgument 0)))" apply (simp only: data_to_obj_type_def returnOk_bindE fun_app_def) apply (simp add: maxBound_def enum_apiobject_type
                     fromEnum_def whenE_def) apply (simp add: returnOk_def APIType_map2_def toEnum_def
                     enum_apiobject_type enum_object_type) apply (intro conjI impI) apply (subgoal_tac "unat v - 5 > 5") apply (simp add: arch_data_to_obj_type_def) apply simp apply (subgoal_tac "\<exists>n. unat v = n + 5") apply (clarsimp simp: arch_data_to_obj_type_def returnOk_def) apply (rule_tac x="unat v - 5" in exI) apply arith done have S: "\<And>x (y :: ('g :: len) word) (z :: 'g word) bits. \<lbrakk> bits < len_of TYPE('g); x < 2 ^ bits \<rbrakk> \<Longrightarrow> toEnum x = (of_nat x :: 'g word)" apply (rule toEnum_of_nat) apply (erule order_less_trans) apply simp done obtain xs where xs: "xs = [unat arg4..<unat arg4 + unat arg5]" by simp have YUCK: "\<And>ref bits.
                  \<lbrakk> is_aligned ref bits;
                    Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits;
                    bits < 32; 1 \<le> arg4 + arg5;
                    arg4 \<le> arg4 + arg5 \<rbrakk> \<Longrightarrow>
              (map (\<lambda>x. ref + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1])
              = map cte_map
               (map (Pair ref)
                 (map (nat_to_cref bits) xs))" apply (subgoal_tac "Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5") apply (simp add: upto_enum_def xs del: upt.simps) apply (clarsimp simp: cte_map_def) apply (subst of_bl_nat_to_cref) apply simp apply (simp add: word_bits_def) apply (subst S) apply simp apply simp apply (simp add: cte_level_bits_def) apply unat_arith done have another:
    "\<And>bits a. \<lbrakk> (a::word32) \<le> 2 ^ bits; bits < word_bits\<rbrakk>
       \<Longrightarrow> 2 ^ bits - a = of_nat (2 ^ bits - unat a)" apply (subst of_nat_diff) apply (subst (asm) word_le_nat_alt) apply (simp add: word_unat_power2) apply simp done have ty_size:
   "\<And>x y. (obj_bits_api (APIType_map2 (Inr x)) y) = (Types_H.getObjectSize x y)" apply (clarsimp simp:obj_bits_api_def APIType_map2_def getObjectSize_def simp del: APIType_capBits) apply (case_tac x) apply (simp_all add:arch_kobj_size_def default_arch_object_def
         pageBits_def pdBits_def ptBits_def) apply (rename_tac apiobject_type) apply (case_tac apiobject_type) apply (simp_all add:apiGetObjectSize_def tcbBlockSizeBits_def epSizeBits_def
         ntfnSizeBits_def slot_bits_def cteSizeBits_def pdeBits_def pteBits_def) done obtain if_res where if_res_def: "\<And>reset. if_res reset = (if reset then 0 else idx)" by auto have if_res_2n:
      "\<And>d res. (\<exists>s. s \<turnstile> cap.UntypedCap d w n idx) \<Longrightarrow> if_res res \<le> 2 ^ n" by (simp add: if_res_def valid_cap_def) note word_unat_power [symmetric, simp del] show ?thesis apply (rule corres_name_pre) apply clarsimp apply (subgoal_tac "cte_wp_at' (\<lambda>cte. cteCap cte = (capability.UntypedCap d w n idx)) (cte_map slot) s'") prefer 2 apply (drule state_relation_pspace_relation) apply (case_tac slot) apply simp apply (drule(1) pspace_relation_cte_wp_at) apply fastforce+ apply (clarsimp simp:cte_wp_at_caps_of_state) apply (frule caps_of_state_valid_cap[unfolded valid_cap_def]) apply fastforce apply (clarsimp simp:cap_aligned_def) 
(* ugh yuck. who likes a word proof? furthermore, some more restriction of
   the returnOk_bindE stuff needs to be done in order to give you a single
   target to do the word proof against or else it needs repeating. ugh.
   maybe could seperate out the equality Isar-style? *)
     apply (simp add: decodeUntypedInvocation_def decode_untyped_invocation_def
                     args cs cs' xs[symmetric] il whenE_rangeCheck_eq
                     cap_case_CNodeCap unlessE_whenE case_bool_If
                     lookupTargetSlot_def
                     untypedBits_defs untyped_min_bits_def untyped_max_bits_def
                del: upt.simps
          split del: if_split
               cong: if_cong list.case_cong) apply (rule corres_guard_imp) apply (rule corres_splitEE[OF Q]) apply (rule corres_whenE_throw_merge) apply (rule whenE_throwError_corres) apply (simp add: word_bits_def word_size) apply (clarsimp simp: word_size word_bits_def fromIntegral_def ty_size
                          toInteger_nat fromInteger_nat wordBits_def) apply (simp add: not_le) apply (rule whenE_throwError_corres, simp) apply (clarsimp simp: fromAPIType_def) apply (rule whenE_throwError_corres, simp) apply (clarsimp simp: fromAPIType_def) apply (rule_tac r' = "\<lambda>cap cap'. cap_relation cap cap'"
                in corres_splitEE) apply (rule corres_if, simp) apply (rule corres_returnOkTT) apply (rule crel) apply simp apply (rule corres_splitEE) apply (rule lookupSlotForCNodeOp_corres) apply (rule crel) apply simp apply simp apply (rule getSlotCap_corres,simp) apply (wp lookup_slot_for_cnode_op_inv
                      hoare_drop_impE_R hoare_vcg_all_lift_R)+ apply (rule_tac corres_split_norE) apply (rule corres_if) apply simp apply (rule corres_returnOk,clarsimp) apply (rule corres_trivial) apply (clarsimp simp: fromAPIType_def lookup_failure_map_def) apply (rule_tac F="is_cnode_cap rva \<and> cap_aligned rva" in corres_gen_asm) apply (subgoal_tac "is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32") prefer 2 apply (clarsimp simp: is_cap_simps bits_of_def cap_aligned_def word_bits_def
                                   is_aligned_weaken) apply (rule whenE_throwError_corres) apply (clarsimp simp:Kernel_Config.retypeFanOutLimit_def is_cap_simps bits_of_def)+ apply (simp add: unat_arith_simps(2) unat_2p_sub_1 word_bits_def) apply (rule whenE_throwError_corres) apply (clarsimp simp:Kernel_Config.retypeFanOutLimit_def is_cap_simps bits_of_def)+ apply (simp add: unat_eq_0 word_less_nat_alt) apply (rule whenE_throwError_corres) apply (clarsimp simp:Kernel_Config.retypeFanOutLimit_def is_cap_simps bits_of_def)+ apply (clarsimp simp:toInteger_word unat_arith_simps(2) cap_aligned_def) apply (subst unat_sub) apply (simp add: linorder_not_less word_le_nat_alt) apply (fold neq0_conv) apply (simp add: unat_eq_0 cap_aligned_def) apply (clarsimp simp:fromAPIType_def) apply (clarsimp simp:liftE_bindE mapM_locate_eq) apply (subgoal_tac "unat (arg4 + arg5) = unat arg4 + unat arg5") prefer 2 apply (clarsimp simp:not_less) apply (subst unat_word_ariths(1)) apply (rule mod_less) apply (unfold word_bits_len_of)[1] apply (subgoal_tac "2 ^ bits_of rva < (2 :: nat) ^ word_bits") apply arith apply (rule power_strict_increasing, simp add: word_bits_conv) apply simp apply (rule_tac P'="valid_cap rva" in corres_stateAssert_implied) apply (frule_tac bits2 = "bits_of rva" in YUCK) apply (simp) apply (simp add: word_bits_conv) apply (simp add: word_le_nat_alt) apply (simp add: word_le_nat_alt) apply (simp add:liftE_bindE[symmetric] free_index_of_def) apply (rule corres_split_norE) apply (clarsimp simp:is_cap_simps  simp del:ser_def) apply (simp add: mapME_x_map_simp  del: ser_def) apply (rule_tac P = "valid_cap (cap.CNodeCap r bits g) and invs" in corres_guard_imp [where P' = invs']) apply (rule mapME_x_corres_inv [OF _ _ _ refl]) apply (simp del: ser_def) apply (rule ensureEmptySlot_corres) apply (clarsimp simp: is_cap_simps) apply (simp, wp) apply (simp, wp) apply clarsimp apply (clarsimp simp add: xs is_cap_simps bits_of_def valid_cap_def) apply (erule cap_table_at_cte_at) apply (simp add: nat_to_cref_def word_bits_conv) apply simp apply (subst liftE_bindE)+ apply (rule corres_split_eqr[OF corres_check_no_children]) apply (simp only: free_index_of_def cap.simps if_res_def[symmetric]) apply (rule_tac F="if_res reset \<le> 2 ^ n" in corres_gen_asm) apply (rule whenE_throwError_corres) apply (clarsimp simp:shiftL_nat word_less_nat_alt shiftr_div_2n'
                              split del: if_split)+ apply (simp add: word_of_nat_le another) apply (drule_tac x = "if_res reset" in unat_of_nat32[OF le_less_trans]) apply (simp add:ty_size shiftR_nat)+ apply (simp add:unat_of_nat32 le_less_trans[OF div_le_dividend]
                                  le_less_trans[OF diff_le_self]) apply (rule whenE_throwError_corres) apply (clarsimp) apply (clarsimp simp: fromAPIType_def) apply (rule corres_returnOkTT) apply (clarsimp simp:ty_size getFreeRef_def get_free_ref_def is_cap_simps) apply simp apply (strengthen if_res_2n, wp) apply simp apply wp apply (wp mapME_x_inv_wp
                        validE_R_validE[OF valid_validE_R[OF ensure_empty_inv]]
                        validE_R_validE[OF valid_validE_R[OF ensureEmpty_inv]])+ apply (clarsimp simp: is_cap_simps valid_cap_simps
                                  cap_table_at_gsCNodes bits_of_def
                                  linorder_not_less) apply (erule order_le_less_trans) apply (rule word_leq_le_minus_one) apply (simp add: word_le_nat_alt) apply (simp add: unat_arith_simps) apply wp+ apply simp apply (rule hoare_strengthen_post [where Q = "\<lambda>r. invs and valid_cap r and cte_at slot"]) apply wp+ apply (clarsimp simp: is_cap_simps bits_of_def cap_aligned_def
                                valid_cap_def word_bits_def) apply (frule caps_of_state_valid_cap, clarsimp+) apply (strengthen refl exI[mk_strg I E] exI[where x=d])+ apply simp apply wp+ apply (rule hoare_strengthen_post [where Q = "\<lambda>r. invs' and cte_at' (cte_map slot)"]) apply wp+ apply (clarsimp simp:invs_pspace_aligned' invs_pspace_distinct') apply auto[1] apply (wp whenE_throwError_wp | wp (once) hoare_drop_imps)+ apply (clarsimp simp: invs_valid_objs' invs_pspace_aligned' invs_pspace_distinct'
                           cte_wp_at_caps_of_state cte_wp_at_ctes_of ) apply (clarsimp simp: invs_valid_objs invs_psp_aligned) apply (frule caps_of_state_valid_cap, clarsimp+) apply (strengthen refl[where t=True] refl exI[mk_strg I E] exI[where x=d])+ apply (clarsimp simp: is_cap_simps valid_cap_def bits_of_def cap_aligned_def
                           cte_level_bits_def word_bits_conv) apply (clarsimp simp: invs_valid_objs' invs_pspace_aligned' invs_pspace_distinct'
                          cte_wp_at_caps_of_state cte_wp_at_ctes_of ) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (state)
goal (2 subgoals):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs')
 2. \<not> (6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype) \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (state)
this:
\<not> (6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype)

goal (2 subgoals):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs')
 2. \<not> (6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype) \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
using this:
\<not> (6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype)
list_all2 cap_relation cs cs'

goal (1 subgoal):
 1. corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>6 \<le> length args \<longrightarrow> cs = [] \<or> gen_invocation_type label \<noteq> UntypedRetype; list_all2 cap_relation cs cs'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (doE y <- whenE (gen_invocation_type label \<noteq> UntypedRetype) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
y <- whenE (length args < 6 \<or> cs = []) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
new_type <- data_to_obj_type (args ! 0);
y <- whenE (unat (args ! Suc 0) < word_bits \<longrightarrow> \<not> obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (word_of_nat untyped_max_bits)));
y <- whenE (new_type = Structures_A.apiobject_type.CapTableObject \<and> unat (args ! Suc 0) = 0 \<or> new_type = Structures_A.apiobject_type.Untyped \<and> unat (args ! Suc 0) < untyped_min_bits) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
node_cap <- if unat (args ! 3) = 0 then returnOk (cs ! 0) else doE node_slot <- lookup_target_slot (cs ! 0) (to_bl (args ! 2)) (unat (args ! 3));
liftE $ get_cap node_slot
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError $ ExceptionTypes_A.syscall_error.FailedLookup False $ ExceptionTypes_A.lookup_failure.MissingCapability (unat (args ! 3));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat (args ! 4)) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat (args ! 5) = 0 \<or> unat retypeFanOutLimit < unat (args ! 5)) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat (args ! 5) = 0 \<or> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5)) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat (args ! 4)))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5)) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type new_type \<and> new_type \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) new_type (unat (args ! Suc 0)) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]) d)
odE) (case args of [] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [newTypeW] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [newTypeW, userObjSizeW] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [newTypeW, userObjSizeW, nodeIndexW] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [newTypeW, userObjSizeW, nodeIndexW, nodeDepthW] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [newTypeW, userObjSizeW, nodeIndexW, nodeDepthW, nodeOffset] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | newTypeW # userObjSizeW # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # x \<Rightarrow> case cs' of [] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | rootCap # xa \<Rightarrow> doE y <- whenE (gen_invocation_type label \<noteq> UntypedRetype) (throwError Fault_H.syscall_error.IllegalOperation);
y <- whenE (fromEnum maxBound < unat newTypeW) (throwError (Fault_H.syscall_error.InvalidArgument 0));
y <- whenE (\<not> unat userObjSizeW < wordBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
y <- rangeCheck (APIType_capBits (toEnum (unat newTypeW)) (unat userObjSizeW)) 0 maxUntypedSizeBits;
y <- whenE (toEnum (unat newTypeW) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat userObjSizeW = 0 \<or> toEnum (unat newTypeW) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat userObjSizeW < minUntypedSizeBits) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat nodeDepthW = 0 then returnOk rootCap else doE nodeSlot <- lookupTargetSlot rootCap nodeIndexW (unat nodeDepthW);
withoutFailure $ getSlotCap nodeSlot
odE;
y <- case nodeCap of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk () | _ \<Rightarrow> throw $ Fault_H.syscall_error.FailedLookup False $ Fault_H.lookup_failure.MissingCapability (unat nodeDepthW);
y <- rangeCheck nodeOffset 0 (2 ^ capCNodeBits nodeCap - 1);
y <- rangeCheck nodeWindow 1 retypeFanOutLimit;
y <- rangeCheck nodeWindow 1 (2 ^ capCNodeBits nodeCap - nodeOffset);
slots <- liftE (mapM (locateSlotCap nodeCap) [nodeOffset .e. nodeOffset + nodeWindow - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else capFreeIndex (capability.UntypedCap d w n idx))) (APIType_capBits (toEnum (unat newTypeW)) (unat userObjSizeW))) < nodeWindow) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else capFreeIndex (capability.UntypedCap d w n idx))))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat newTypeW)) \<and> toEnum (unat newTypeW) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else capFreeIndex (capability.UntypedCap d w n idx))) (APIType_capBits (toEnum (unat newTypeW)) (unat userObjSizeW))) (toEnum (unat newTypeW)) (unat userObjSizeW) slots d)
odE) proof (prove)
goal:
No subgoals! proof (state)
this:
corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs')

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (state)
goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (state)
this:
6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>n xs. n \<noteq> 0 \<Longrightarrow> (n \<le> length xs) = (\<exists>y ys. xs = y # ys \<and> n - 1 \<le> length ys) proof (prove)
goal (1 subgoal):
 1. \<And>n xs a list. \<lbrakk>0 < n; xs = a # list\<rbrakk> \<Longrightarrow> (n \<le> Suc (length list)) = (n - Suc 0 \<le> length list) proof (prove)
goal:
No subgoals! proof (state)
this:
?n \<noteq> 0 \<Longrightarrow> (?n \<le> length ?xs) = (\<exists>y ys. ?xs = y # ys \<and> ?n - 1 \<le> length ys)

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. (\<And>arg0 arg1 arg2 arg3 arg4 arg5 argsmore cap csmore cap' csmore'. \<lbrakk>args = arg0 # arg1 # arg2 # arg3 # arg4 # arg5 # argsmore; cs = cap # csmore; cs' = cap' # csmore'; cap_relation cap cap'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (prove)
using this:
6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype
list_all2 cap_relation cs cs'

goal (1 subgoal):
 1. (\<And>arg0 arg1 arg2 arg3 arg4 arg5 argsmore cap csmore cap' csmore'. \<lbrakk>args = arg0 # arg1 # arg2 # arg3 # arg4 # arg5 # argsmore; cs = cap # csmore; cs' = cap' # csmore'; cap_relation cap cap'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (state)
this:
args = arg0 # arg1 # arg2 # arg3 # arg4 # arg5 # argsmore
cs = cap # csmore
cs' = cap' # csmore'
cap_relation cap cap'

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. gen_invocation_type label = UntypedRetype proof (prove)
using this:
6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype

goal (1 subgoal):
 1. gen_invocation_type label = UntypedRetype proof (state)
this:
gen_invocation_type label = UntypedRetype

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>bits. bits < 32 \<or> bits < word_bits \<Longrightarrow> unat (2 ^ bits) = 2 ^ bits proof (state)
this:
?bits1 < 32 \<or> ?bits1 < word_bits \<Longrightarrow> unat (2 ^ ?bits1) = 2 ^ ?bits1

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>P. corres (ser \<oplus> dc) (\<lambda>_. True) (\<lambda>_. True) (whenE P (throwError ExceptionTypes_A.syscall_error.TruncatedMessage)) (whenE P (throwError Fault_H.syscall_error.TruncatedMessage)) proof (state)
this:
corres (ser \<oplus> dc) (\<lambda>_. True) (\<lambda>_. True) (whenE ?P1 (throwError ExceptionTypes_A.syscall_error.TruncatedMessage)) (whenE ?P1 (throwError Fault_H.syscall_error.TruncatedMessage))

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>v. corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum (unat v))) = a)) (\<lambda>_. True) (\<lambda>_. True) (data_to_obj_type v) (whenE (fromEnum maxBound < unat v) (throwError (Fault_H.syscall_error.InvalidArgument 0))) proof (prove)
goal (1 subgoal):
 1. \<And>v. corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum (unat v))) = a)) (\<lambda>_. True) (\<lambda>_. True) (if data_to_nat v = 0 then returnOk Structures_A.apiobject_type.Untyped else if data_to_nat v = 1 then returnOk Structures_A.apiobject_type.TCBObject else if data_to_nat v = 2 then returnOk Structures_A.apiobject_type.EndpointObject else if data_to_nat v = 3 then returnOk Structures_A.apiobject_type.NotificationObject else if data_to_nat v = 4 then returnOk Structures_A.apiobject_type.CapTableObject else case arch_data_to_obj_type (data_to_nat v - 5) of None \<Rightarrow> throwError (ExceptionTypes_A.syscall_error.InvalidArgument 0) | Some tp \<Rightarrow> returnOk (ArchObject tp)) (whenE (fromEnum maxBound < unat v) (throwError (Fault_H.syscall_error.InvalidArgument 0))) proof (prove)
goal (1 subgoal):
 1. \<And>v. (unat v = 4 \<longrightarrow> (the_index enum (last enum) < 4 \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum 4)) = a)) (\<lambda>_. True) (\<lambda>_. True) (returnOk Structures_A.apiobject_type.CapTableObject) (throwError (Fault_H.syscall_error.InvalidArgument 0))) \<and> (\<not> the_index enum (last enum) < 4 \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum 4)) = a)) (\<lambda>_. True) (\<lambda>_. True) (returnOk Structures_A.apiobject_type.CapTableObject) (returnOk ()))) \<and> (unat v \<noteq> 4 \<longrightarrow> (unat v = 3 \<longrightarrow> (the_index enum (last enum) < 3 \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum 3)) = a)) (\<lambda>_. True) (\<lambda>_. True) (returnOk Structures_A.apiobject_type.NotificationObject) (throwError (Fault_H.syscall_error.InvalidArgument 0))) \<and> (\<not> the_index enum (last enum) < 3 \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum 3)) = a)) (\<lambda>_. True) (\<lambda>_. True) (returnOk Structures_A.apiobject_type.NotificationObject) (returnOk ()))) \<and> (unat v \<noteq> 3 \<longrightarrow> (unat v = 2 \<longrightarrow> (the_index enum (last enum) < 2 \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum 2)) = a)) (\<lambda>_. True) (\<lambda>_. True) (returnOk Structures_A.apiobject_type.EndpointObject) (throwError (Fault_H.syscall_error.InvalidArgument 0))) \<and> (\<not> the_index enum (last enum) < 2 \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum 2)) = a)) (\<lambda>_. True) (\<lambda>_. True) (returnOk Structures_A.apiobject_type.EndpointObject) (returnOk ()))) \<and> (unat v \<noteq> 2 \<longrightarrow> (unat v = Suc 0 \<longrightarrow> (the_index enum (last enum) = 0 \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum (Suc 0))) = a)) (\<lambda>_. True) (\<lambda>_. True) (returnOk Structures_A.apiobject_type.TCBObject) (throwError (Fault_H.syscall_error.InvalidArgument 0))) \<and> (0 < the_index enum (last enum) \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum (Suc 0))) = a)) (\<lambda>_. True) (\<lambda>_. True) (returnOk Structures_A.apiobject_type.TCBObject) (returnOk ()))) \<and> (unat v \<noteq> Suc 0 \<longrightarrow> (unat v = 0 \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum 0)) = a)) (\<lambda>_. True) (\<lambda>_. True) (returnOk Structures_A.apiobject_type.Untyped) (returnOk ())) \<and> (0 < unat v \<longrightarrow> (the_index enum (last enum) < unat v \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum (unat v))) = a)) (\<lambda>_. True) (\<lambda>_. True) (case arch_data_to_obj_type (unat v - 5) of None \<Rightarrow> throwError (ExceptionTypes_A.syscall_error.InvalidArgument 0) | Some tp \<Rightarrow> returnOk (ArchObject tp)) (throwError (Fault_H.syscall_error.InvalidArgument 0))) \<and> (\<not> the_index enum (last enum) < unat v \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum (unat v))) = a)) (\<lambda>_. True) (\<lambda>_. True) (case arch_data_to_obj_type (unat v - 5) of None \<Rightarrow> throwError (ExceptionTypes_A.syscall_error.InvalidArgument 0) | Some tp \<Rightarrow> returnOk (ArchObject tp)) (returnOk ()))))))) proof (prove)
goal (1 subgoal):
 1. \<And>v. unat v \<noteq> 4 \<longrightarrow> unat v \<noteq> 3 \<longrightarrow> unat v \<noteq> 2 \<longrightarrow> unat v \<noteq> Suc 0 \<longrightarrow> 0 < unat v \<longrightarrow> (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. (case the None of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj) = a)) (\<lambda>_. True) (\<lambda>_. True) (case arch_data_to_obj_type (unat v - 5) of None \<Rightarrow> throwError (ExceptionTypes_A.syscall_error.InvalidArgument 0) | Some tp \<Rightarrow> return (Inr (ArchObject tp))) (throwError (Fault_H.syscall_error.InvalidArgument 0))) \<and> (\<not> Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v \<longrightarrow> corres (ser \<oplus> (\<lambda>a b. (case [PageDirectoryObject, SmallPageObject, LargePageObject, SectionObject, SuperSectionObject, PageTableObject] ! (unat v - Suc (Suc (Suc (Suc (Suc 0))))) of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj) = a)) (\<lambda>_. True) (\<lambda>_. True) (case arch_data_to_obj_type (unat v - 5) of None \<Rightarrow> throwError (ExceptionTypes_A.syscall_error.InvalidArgument 0) | Some tp \<Rightarrow> return (Inr (ArchObject tp))) (return (Inr ()))) proof (prove)
goal (2 subgoals):
 1. \<And>v. \<lbrakk>unat v \<noteq> 4; unat v \<noteq> 3; unat v \<noteq> 2; unat v \<noteq> Suc 0; 0 < unat v; Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v\<rbrakk> \<Longrightarrow> corres (ser \<oplus> (\<lambda>a b. (case the None of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj) = a)) (\<lambda>_. True) (\<lambda>_. True) (case arch_data_to_obj_type (unat v - 5) of None \<Rightarrow> throwError (ExceptionTypes_A.syscall_error.InvalidArgument 0) | Some tp \<Rightarrow> return (Inr (ArchObject tp))) (throwError (Fault_H.syscall_error.InvalidArgument 0))
 2. \<And>v. \<lbrakk>unat v \<noteq> 4; unat v \<noteq> 3; unat v \<noteq> 2; unat v \<noteq> Suc 0; 0 < unat v; \<not> Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v\<rbrakk> \<Longrightarrow> corres (ser \<oplus> (\<lambda>a b. (case [PageDirectoryObject, SmallPageObject, LargePageObject, SectionObject, SuperSectionObject, PageTableObject] ! (unat v - Suc (Suc (Suc (Suc (Suc 0))))) of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj) = a)) (\<lambda>_. True) (\<lambda>_. True) (case arch_data_to_obj_type (unat v - 5) of None \<Rightarrow> throwError (ExceptionTypes_A.syscall_error.InvalidArgument 0) | Some tp \<Rightarrow> return (Inr (ArchObject tp))) (return (Inr ())) proof (prove)
goal (3 subgoals):
 1. \<And>v. \<lbrakk>unat v \<noteq> 4; unat v \<noteq> 3; unat v \<noteq> 2; unat v \<noteq> Suc 0; 0 < unat v; Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v; 5 < unat v - 5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> (\<lambda>a b. (case the None of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj) = a)) (\<lambda>_. True) (\<lambda>_. True) (case arch_data_to_obj_type (unat v - 5) of None \<Rightarrow> throwError (ExceptionTypes_A.syscall_error.InvalidArgument 0) | Some tp \<Rightarrow> return (Inr (ArchObject tp))) (throwError (Fault_H.syscall_error.InvalidArgument 0))
 2. \<And>v. \<lbrakk>unat v \<noteq> 4; unat v \<noteq> 3; unat v \<noteq> 2; unat v \<noteq> Suc 0; 0 < unat v; Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v\<rbrakk> \<Longrightarrow> 5 < unat v - 5
 3. \<And>v. \<lbrakk>unat v \<noteq> 4; unat v \<noteq> 3; unat v \<noteq> 2; unat v \<noteq> Suc 0; 0 < unat v; \<not> Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v\<rbrakk> \<Longrightarrow> corres (ser \<oplus> (\<lambda>a b. (case [PageDirectoryObject, SmallPageObject, LargePageObject, SectionObject, SuperSectionObject, PageTableObject] ! (unat v - Suc (Suc (Suc (Suc (Suc 0))))) of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj) = a)) (\<lambda>_. True) (\<lambda>_. True) (case arch_data_to_obj_type (unat v - 5) of None \<Rightarrow> throwError (ExceptionTypes_A.syscall_error.InvalidArgument 0) | Some tp \<Rightarrow> return (Inr (ArchObject tp))) (return (Inr ())) proof (prove)
goal (2 subgoals):
 1. \<And>v. \<lbrakk>unat v \<noteq> 4; unat v \<noteq> 3; unat v \<noteq> 2; unat v \<noteq> Suc 0; 0 < unat v; Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v\<rbrakk> \<Longrightarrow> 5 < unat v - 5
 2. \<And>v. \<lbrakk>unat v \<noteq> 4; unat v \<noteq> 3; unat v \<noteq> 2; unat v \<noteq> Suc 0; 0 < unat v; \<not> Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v\<rbrakk> \<Longrightarrow> corres (ser \<oplus> (\<lambda>a b. (case [PageDirectoryObject, SmallPageObject, LargePageObject, SectionObject, SuperSectionObject, PageTableObject] ! (unat v - Suc (Suc (Suc (Suc (Suc 0))))) of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj) = a)) (\<lambda>_. True) (\<lambda>_. True) (case arch_data_to_obj_type (unat v - 5) of None \<Rightarrow> throwError (ExceptionTypes_A.syscall_error.InvalidArgument 0) | Some tp \<Rightarrow> return (Inr (ArchObject tp))) (return (Inr ())) proof (prove)
goal (1 subgoal):
 1. \<And>v. \<lbrakk>unat v \<noteq> 4; unat v \<noteq> 3; unat v \<noteq> 2; unat v \<noteq> Suc 0; 0 < unat v; \<not> Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v\<rbrakk> \<Longrightarrow> corres (ser \<oplus> (\<lambda>a b. (case [PageDirectoryObject, SmallPageObject, LargePageObject, SectionObject, SuperSectionObject, PageTableObject] ! (unat v - Suc (Suc (Suc (Suc (Suc 0))))) of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj) = a)) (\<lambda>_. True) (\<lambda>_. True) (case arch_data_to_obj_type (unat v - 5) of None \<Rightarrow> throwError (ExceptionTypes_A.syscall_error.InvalidArgument 0) | Some tp \<Rightarrow> return (Inr (ArchObject tp))) (return (Inr ())) proof (prove)
goal (2 subgoals):
 1. \<And>v. \<lbrakk>unat v \<noteq> 4; unat v \<noteq> 3; unat v \<noteq> 2; unat v \<noteq> Suc 0; 0 < unat v; \<not> Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v; \<exists>n. unat v = n + 5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> (\<lambda>a b. (case [PageDirectoryObject, SmallPageObject, LargePageObject, SectionObject, SuperSectionObject, PageTableObject] ! (unat v - Suc (Suc (Suc (Suc (Suc 0))))) of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj) = a)) (\<lambda>_. True) (\<lambda>_. True) (case arch_data_to_obj_type (unat v - 5) of None \<Rightarrow> throwError (ExceptionTypes_A.syscall_error.InvalidArgument 0) | Some tp \<Rightarrow> return (Inr (ArchObject tp))) (return (Inr ()))
 2. \<And>v. \<lbrakk>unat v \<noteq> 4; unat v \<noteq> 3; unat v \<noteq> 2; unat v \<noteq> Suc 0; 0 < unat v; \<not> Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v\<rbrakk> \<Longrightarrow> \<exists>n. unat v = n + 5 proof (prove)
goal (1 subgoal):
 1. \<And>v. \<lbrakk>unat v \<noteq> 4; unat v \<noteq> 3; unat v \<noteq> 2; unat v \<noteq> Suc 0; 0 < unat v; \<not> Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v\<rbrakk> \<Longrightarrow> \<exists>n. unat v = n + 5 proof (prove)
goal (1 subgoal):
 1. \<And>v. \<lbrakk>unat v \<noteq> 4; unat v \<noteq> 3; unat v \<noteq> 2; unat v \<noteq> Suc 0; 0 < unat v; \<not> Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))) < unat v\<rbrakk> \<Longrightarrow> unat v = unat v - 5 + 5 proof (prove)
goal:
No subgoals! proof (state)
this:
corres (ser \<oplus> (\<lambda>a b. APIType_map2 (Inr (toEnum (unat ?v1))) = a)) (\<lambda>_. True) (\<lambda>_. True) (data_to_obj_type ?v1) (whenE (fromEnum maxBound < unat ?v1) (throwError (Fault_H.syscall_error.InvalidArgument 0)))

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>x y z bits. \<lbrakk>bits < LENGTH('g); x < 2 ^ bits\<rbrakk> \<Longrightarrow> toEnum x = word_of_nat x proof (prove)
goal (1 subgoal):
 1. \<And>x y z bits. \<lbrakk>bits < LENGTH('g); x < 2 ^ bits\<rbrakk> \<Longrightarrow> x < 2 ^ LENGTH('g) proof (prove)
goal (1 subgoal):
 1. \<And>x y z bits. bits < LENGTH('g) \<Longrightarrow> 2 ^ bits < 2 ^ LENGTH('g) proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>?bits1 < LENGTH(?'g2); ?x1 < 2 ^ ?bits1\<rbrakk> \<Longrightarrow> toEnum ?x1 = word_of_nat ?x1

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. (\<And>xs. xs = [unat arg4..<unat arg4 + unat arg5] \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (state)
this:
xs = [unat arg4..<unat arg4 + unat arg5]

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5\<rbrakk> \<Longrightarrow> map (\<lambda>x. ref + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map cte_map (map (Pair ref) (map (nat_to_cref bits) xs)) proof (prove)
goal (2 subgoals):
 1. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> map (\<lambda>x. ref + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map cte_map (map (Pair ref) (map (nat_to_cref bits) xs))
 2. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5\<rbrakk> \<Longrightarrow> Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5 proof (prove)
goal (2 subgoals):
 1. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> \<forall>x\<in>{unat arg4..<unat arg4 + unat arg5}. ref + 2 ^ cte_level_bits * toEnum x = cte_map (ref, nat_to_cref bits x)
 2. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5\<rbrakk> \<Longrightarrow> Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5 proof (prove)
goal (2 subgoals):
 1. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> 2 ^ cte_level_bits * toEnum x = of_bl (nat_to_cref bits x) * 2 ^ cte_level_bits
 2. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5\<rbrakk> \<Longrightarrow> Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5 proof (prove)
goal (4 subgoals):
 1. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> x < 2 ^ bits
 2. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> bits < word_bits
 3. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> 2 ^ cte_level_bits * toEnum x = word_of_nat x * 2 ^ cte_level_bits
 4. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5\<rbrakk> \<Longrightarrow> Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5 proof (prove)
goal (3 subgoals):
 1. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> bits < word_bits
 2. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> 2 ^ cte_level_bits * toEnum x = word_of_nat x * 2 ^ cte_level_bits
 3. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5\<rbrakk> \<Longrightarrow> Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5 proof (prove)
goal (2 subgoals):
 1. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> 2 ^ cte_level_bits * toEnum x = word_of_nat x * 2 ^ cte_level_bits
 2. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5\<rbrakk> \<Longrightarrow> Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5 proof (prove)
goal (4 subgoals):
 1. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> ?bits24 ref bits x < LENGTH(32)
 2. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> x < 2 ^ ?bits24 ref bits x
 3. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> 2 ^ cte_level_bits * word_of_nat x = word_of_nat x * 2 ^ cte_level_bits
 4. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5\<rbrakk> \<Longrightarrow> Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5 proof (prove)
goal (3 subgoals):
 1. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> x < 2 ^ bits
 2. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> 2 ^ cte_level_bits * word_of_nat x = word_of_nat x * 2 ^ cte_level_bits
 3. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5\<rbrakk> \<Longrightarrow> Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5 proof (prove)
goal (2 subgoals):
 1. \<And>ref bits x. \<lbrakk>is_aligned ref bits; unat arg4 + unat arg5 \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5; Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> 2 ^ cte_level_bits * word_of_nat x = word_of_nat x * 2 ^ cte_level_bits
 2. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5\<rbrakk> \<Longrightarrow> Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5 proof (prove)
goal (1 subgoal):
 1. \<And>ref bits. \<lbrakk>is_aligned ref bits; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits; bits < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5\<rbrakk> \<Longrightarrow> Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5 proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>is_aligned ?ref2 ?bits2; Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ ?bits2; ?bits2 < 32; 1 \<le> arg4 + arg5; arg4 \<le> arg4 + arg5\<rbrakk> \<Longrightarrow> map (\<lambda>x. ?ref2 + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map cte_map (map (Pair ?ref2) (map (nat_to_cref ?bits2) xs))

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>bits a. \<lbrakk>a \<le> 2 ^ bits; bits < word_bits\<rbrakk> \<Longrightarrow> 2 ^ bits - a = word_of_nat (2 ^ bits - unat a) proof (prove)
goal (2 subgoals):
 1. \<And>bits a. \<lbrakk>a \<le> 2 ^ bits; bits < word_bits\<rbrakk> \<Longrightarrow> unat a \<le> 2 ^ bits
 2. \<And>bits a. \<lbrakk>a \<le> 2 ^ bits; bits < word_bits\<rbrakk> \<Longrightarrow> 2 ^ bits - a = word_of_nat (2 ^ bits) - word_of_nat (unat a) proof (prove)
goal (2 subgoals):
 1. \<And>bits a. \<lbrakk>unat a \<le> unat (2 ^ bits); bits < word_bits\<rbrakk> \<Longrightarrow> unat a \<le> 2 ^ bits
 2. \<And>bits a. \<lbrakk>a \<le> 2 ^ bits; bits < word_bits\<rbrakk> \<Longrightarrow> 2 ^ bits - a = word_of_nat (2 ^ bits) - word_of_nat (unat a) proof (prove)
goal (1 subgoal):
 1. \<And>bits a. \<lbrakk>a \<le> 2 ^ bits; bits < word_bits\<rbrakk> \<Longrightarrow> 2 ^ bits - a = word_of_nat (2 ^ bits) - word_of_nat (unat a) proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>?a2 \<le> 2 ^ ?bits2; ?bits2 < word_bits\<rbrakk> \<Longrightarrow> 2 ^ ?bits2 - ?a2 = word_of_nat (2 ^ ?bits2 - unat ?a2)

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>x y. obj_bits_api (APIType_map2 (Inr x)) y = getObjectSize x y proof (prove)
goal (1 subgoal):
 1. \<And>x y. (case case x of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = (case x of APIObjectType apiObjectType \<Rightarrow> apiGetObjectSize apiObjectType y | SmallPageObject \<Rightarrow> pageBitsForSize ARMSmallPage | LargePageObject \<Rightarrow> pageBitsForSize ARMLargePage | SectionObject \<Rightarrow> pageBitsForSize ARMSection | SuperSectionObject \<Rightarrow> pageBitsForSize ARMSuperSection | PageTableObject \<Rightarrow> ptBits | PageDirectoryObject \<Rightarrow> pdBits) proof (prove)
goal (7 subgoals):
 1. \<And>x y x1. x = APIObjectType x1 \<Longrightarrow> (case case x of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = (case x of APIObjectType apiObjectType \<Rightarrow> apiGetObjectSize apiObjectType y | SmallPageObject \<Rightarrow> pageBitsForSize ARMSmallPage | LargePageObject \<Rightarrow> pageBitsForSize ARMLargePage | SectionObject \<Rightarrow> pageBitsForSize ARMSection | SuperSectionObject \<Rightarrow> pageBitsForSize ARMSuperSection | PageTableObject \<Rightarrow> ptBits | PageDirectoryObject \<Rightarrow> pdBits)
 2. \<And>x y. x = SmallPageObject \<Longrightarrow> (case case x of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = (case x of APIObjectType apiObjectType \<Rightarrow> apiGetObjectSize apiObjectType y | SmallPageObject \<Rightarrow> pageBitsForSize ARMSmallPage | LargePageObject \<Rightarrow> pageBitsForSize ARMLargePage | SectionObject \<Rightarrow> pageBitsForSize ARMSection | SuperSectionObject \<Rightarrow> pageBitsForSize ARMSuperSection | PageTableObject \<Rightarrow> ptBits | PageDirectoryObject \<Rightarrow> pdBits)
 3. \<And>x y. x = LargePageObject \<Longrightarrow> (case case x of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = (case x of APIObjectType apiObjectType \<Rightarrow> apiGetObjectSize apiObjectType y | SmallPageObject \<Rightarrow> pageBitsForSize ARMSmallPage | LargePageObject \<Rightarrow> pageBitsForSize ARMLargePage | SectionObject \<Rightarrow> pageBitsForSize ARMSection | SuperSectionObject \<Rightarrow> pageBitsForSize ARMSuperSection | PageTableObject \<Rightarrow> ptBits | PageDirectoryObject \<Rightarrow> pdBits)
 4. \<And>x y. x = SectionObject \<Longrightarrow> (case case x of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = (case x of APIObjectType apiObjectType \<Rightarrow> apiGetObjectSize apiObjectType y | SmallPageObject \<Rightarrow> pageBitsForSize ARMSmallPage | LargePageObject \<Rightarrow> pageBitsForSize ARMLargePage | SectionObject \<Rightarrow> pageBitsForSize ARMSection | SuperSectionObject \<Rightarrow> pageBitsForSize ARMSuperSection | PageTableObject \<Rightarrow> ptBits | PageDirectoryObject \<Rightarrow> pdBits)
 5. \<And>x y. x = SuperSectionObject \<Longrightarrow> (case case x of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = (case x of APIObjectType apiObjectType \<Rightarrow> apiGetObjectSize apiObjectType y | SmallPageObject \<Rightarrow> pageBitsForSize ARMSmallPage | LargePageObject \<Rightarrow> pageBitsForSize ARMLargePage | SectionObject \<Rightarrow> pageBitsForSize ARMSection | SuperSectionObject \<Rightarrow> pageBitsForSize ARMSuperSection | PageTableObject \<Rightarrow> ptBits | PageDirectoryObject \<Rightarrow> pdBits)
 6. \<And>x y. x = PageTableObject \<Longrightarrow> (case case x of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = (case x of APIObjectType apiObjectType \<Rightarrow> apiGetObjectSize apiObjectType y | SmallPageObject \<Rightarrow> pageBitsForSize ARMSmallPage | LargePageObject \<Rightarrow> pageBitsForSize ARMLargePage | SectionObject \<Rightarrow> pageBitsForSize ARMSection | SuperSectionObject \<Rightarrow> pageBitsForSize ARMSuperSection | PageTableObject \<Rightarrow> ptBits | PageDirectoryObject \<Rightarrow> pdBits)
 7. \<And>x y. x = PageDirectoryObject \<Longrightarrow> (case case x of APIObjectType ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | APIObjectType ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | APIObjectType ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | APIObjectType ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject | SmallPageObject \<Rightarrow> ArchObject SmallPageObj | LargePageObject \<Rightarrow> ArchObject LargePageObj | SectionObject \<Rightarrow> ArchObject SectionObj | SuperSectionObject \<Rightarrow> ArchObject SuperSectionObj | PageTableObject \<Rightarrow> ArchObject PageTableObj | PageDirectoryObject \<Rightarrow> ArchObject PageDirectoryObj of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = (case x of APIObjectType apiObjectType \<Rightarrow> apiGetObjectSize apiObjectType y | SmallPageObject \<Rightarrow> pageBitsForSize ARMSmallPage | LargePageObject \<Rightarrow> pageBitsForSize ARMLargePage | SectionObject \<Rightarrow> pageBitsForSize ARMSection | SuperSectionObject \<Rightarrow> pageBitsForSize ARMSuperSection | PageTableObject \<Rightarrow> ptBits | PageDirectoryObject \<Rightarrow> pdBits) proof (prove)
goal (3 subgoals):
 1. \<And>x y x1. x = APIObjectType x1 \<Longrightarrow> (case case x1 of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = apiGetObjectSize x1 y
 2. pteBits = 2
 3. pdeBits = 2 proof (prove)
goal (3 subgoals):
 1. \<And>x y apiobject_type. x = APIObjectType apiobject_type \<Longrightarrow> (case case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = apiGetObjectSize apiobject_type y
 2. pteBits = 2
 3. pdeBits = 2 proof (prove)
goal (7 subgoals):
 1. \<And>x y apiobject_type. \<lbrakk>x = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> (case case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = apiGetObjectSize apiobject_type y
 2. \<And>x y apiobject_type. \<lbrakk>x = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (case case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = apiGetObjectSize apiobject_type y
 3. \<And>x y apiobject_type. \<lbrakk>x = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (case case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = apiGetObjectSize apiobject_type y
 4. \<And>x y apiobject_type. \<lbrakk>x = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (case case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = apiGetObjectSize apiobject_type y
 5. \<And>x y apiobject_type. \<lbrakk>x = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (case case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> Structures_A.apiobject_type.Untyped | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> Structures_A.apiobject_type.TCBObject | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> Structures_A.apiobject_type.EndpointObject | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> Structures_A.apiobject_type.NotificationObject | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> Structures_A.apiobject_type.CapTableObject of Structures_A.apiobject_type.Untyped \<Rightarrow> y | Structures_A.apiobject_type.TCBObject \<Rightarrow> obj_bits (TCB default_tcb) | Structures_A.apiobject_type.EndpointObject \<Rightarrow> obj_bits (Endpoint undefined) | Structures_A.apiobject_type.NotificationObject \<Rightarrow> obj_bits (Notification undefined) | Structures_A.apiobject_type.CapTableObject \<Rightarrow> y + slot_bits | ArchObject aobj \<Rightarrow> obj_bits $ ArchObj $ default_arch_object aobj False y) = apiGetObjectSize apiobject_type y
 6. pteBits = 2
 7. pdeBits = 2 proof (prove)
goal:
No subgoals! proof (state)
this:
obj_bits_api (APIType_map2 (Inr ?x2)) ?y2 = getObjectSize ?x2 ?y2

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. (\<And>if_res. (\<And>reset. if_res reset = (if reset then 0 else idx)) \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (state)
this:
if_res ?reset2 = (if ?reset2 then 0 else idx)

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>d res. \<exists>s. s \<turnstile> cap.UntypedCap d w n idx \<Longrightarrow> if_res res \<le> 2 ^ n proof (state)
this:
\<exists>s. s \<turnstile> cap.UntypedCap ?d2 w n idx \<Longrightarrow> if_res ?res2 \<le> 2 ^ n

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (state)
this:
word_of_nat (2 ^ ?n) = 2 ^ ?n

goal (1 subgoal):
 1. 6 \<le> length args \<and> cs \<noteq> [] \<and> gen_invocation_type label = UntypedRetype \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) s; (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs')
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s' proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x; pspace_relation (kheap s) (ksPSpace s')\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (2 subgoals):
 1. \<And>s s' a b. \<lbrakk>invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x; pspace_relation (kheap s) (ksPSpace s'); slot = (a, b)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (2 subgoals):
 1. \<And>s s' a b. \<lbrakk>invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) (a, b) s; \<forall>x\<in>set cs. s \<turnstile> x; pspace_relation (kheap s) (ksPSpace s'); slot = (a, b)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map (a, b)) s'
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (4 subgoals):
 1. \<And>s s' a b. \<lbrakk>invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) (a, b) s; \<forall>x\<in>set cs. s \<turnstile> x; slot = (a, b)\<rbrakk> \<Longrightarrow> pspace_aligned' s'
 2. \<And>s s' a b. \<lbrakk>invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) (a, b) s; \<forall>x\<in>set cs. s \<turnstile> x; slot = (a, b)\<rbrakk> \<Longrightarrow> pspace_distinct' s'
 3. \<And>s s' a b. \<lbrakk>invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) (a, b) s; \<forall>x\<in>set cs. s \<turnstile> x; slot = (a, b); cte_wp_at' (\<lambda>cte. cap_relation (cap.UntypedCap d w n idx) (cteCap cte)) (cte_map (a, b)) s'\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map (a, b)) s'
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; cap_aligned (cap.UntypedCap d w n idx) \<and> (case cap.UntypedCap d w n idx of cap.UntypedCap dev p b f \<Rightarrow> valid_untyped (cap.UntypedCap d w n idx) s \<and> untyped_min_bits \<le> b \<and> f \<le> 2 ^ b \<and> p \<noteq> 0 | cap.EndpointCap r badge rights \<Rightarrow> ep_at r s | cap.NotificationCap r badge rights \<Rightarrow> ntfn_at r s \<and> AllowGrant \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.ReplyCap r m rights \<Rightarrow> tcb_at r s \<and> AllowWrite \<in> rights \<and> AllowRead \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.CNodeCap r bits guard \<Rightarrow> cap_table_at bits r s \<and> bits \<noteq> 0 \<and> length guard \<le> word_bits | cap.ThreadCap r \<Rightarrow> tcb_at r s | cap.IRQHandlerCap irq \<Rightarrow> irq \<le> maxIRQ | cap.Zombie r None n \<Rightarrow> tcb_at r s \<and> n \<le> 5 | cap.Zombie r (Some ba) n \<Rightarrow> cap_table_at ba r s \<and> n \<le> 2 ^ ba \<and> ba \<noteq> 0 | cap.ArchObjectCap (arch_cap.ASIDPoolCap r as) \<Rightarrow> typ_at (AArch AASIDPool) r s \<and> is_aligned as local.asid_low_bits \<and> as \<le> 2 ^ local.asid_bits - 1 | cap.ArchObjectCap arch_cap.ASIDControlCap \<Rightarrow> True | cap.ArchObjectCap (arch_cap.PageCap dev r rghts sz mapdata) \<Rightarrow> (if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s) \<and> rghts \<in> valid_vm_rights \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned ref sz \<and> ref < kernel_base) | cap.ArchObjectCap (arch_cap.PageTableCap r mapdata) \<Rightarrow> typ_at (AArch APageTable) r s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, vref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vref < kernel_base \<and> is_aligned vref (pageBitsForSize ARMSection)) | cap.ArchObjectCap (arch_cap.PageDirectoryCap r mapdata) \<Rightarrow> typ_at (AArch APageDirectory) r s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | _ \<Rightarrow> True)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; cap_aligned (cap.UntypedCap d w n idx) \<and> (case cap.UntypedCap d w n idx of cap.UntypedCap dev p b f \<Rightarrow> valid_untyped (cap.UntypedCap d w n idx) s \<and> untyped_min_bits \<le> b \<and> f \<le> 2 ^ b \<and> p \<noteq> 0 | cap.EndpointCap r badge rights \<Rightarrow> ep_at r s | cap.NotificationCap r badge rights \<Rightarrow> ntfn_at r s \<and> AllowGrant \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.ReplyCap r m rights \<Rightarrow> tcb_at r s \<and> AllowWrite \<in> rights \<and> AllowRead \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.CNodeCap r bits guard \<Rightarrow> cap_table_at bits r s \<and> bits \<noteq> 0 \<and> length guard \<le> word_bits | cap.ThreadCap r \<Rightarrow> tcb_at r s | cap.IRQHandlerCap irq \<Rightarrow> irq \<le> maxIRQ | cap.Zombie r None n \<Rightarrow> tcb_at r s \<and> n \<le> 5 | cap.Zombie r (Some ba) n \<Rightarrow> cap_table_at ba r s \<and> n \<le> 2 ^ ba \<and> ba \<noteq> 0 | cap.ArchObjectCap (arch_cap.ASIDPoolCap r as) \<Rightarrow> typ_at (AArch AASIDPool) r s \<and> is_aligned as local.asid_low_bits \<and> as \<le> 2 ^ local.asid_bits - 1 | cap.ArchObjectCap arch_cap.ASIDControlCap \<Rightarrow> True | cap.ArchObjectCap (arch_cap.PageCap dev r rghts sz mapdata) \<Rightarrow> (if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s) \<and> rghts \<in> valid_vm_rights \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned ref sz \<and> ref < kernel_base) | cap.ArchObjectCap (arch_cap.PageTableCap r mapdata) \<Rightarrow> typ_at (AArch APageTable) r s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, vref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vref < kernel_base \<and> is_aligned vref (pageBitsForSize ARMSection)) | cap.ArchObjectCap (arch_cap.PageDirectoryCap r mapdata) \<Rightarrow> typ_at (AArch APageDirectory) r s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | _ \<Rightarrow> True)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; untyped_min_bits \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; \<forall>x\<in>set cs'. valid_cap' x s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); \<forall>x\<in>set cs. s \<turnstile> x; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; untyped_min_bits \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs') proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) ((=) s) ((=) s') (doE new_type <- data_to_obj_type arg0;
y <- whenE (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api new_type (unat arg1) \<le> 29) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 0x1D));
y <- whenE (new_type = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (new_type = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
node_cap <- if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of node_cap - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api new_type (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type new_type \<and> new_type \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api new_type (unat arg1))) new_type (unat arg1) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs) d)
odE) (doE y <- whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0));
y <- whenE (\<not> unat arg1 < wordBits) (throwError (Fault_H.syscall_error.RangeError 0 0x1D));
y <- whenE (29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) (throwError (Fault_H.syscall_error.RangeError 0 0x1D));
y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE;
y <- if isCNodeCap nodeCap then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits nodeCap - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits nodeCap - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - arg4)));
slots <- liftE (mapM (locateSlotCap nodeCap) [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE) proof (prove)
goal (3 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q33 s s') (?Q'33 s s') (doE new_type <- data_to_obj_type arg0;
y <- whenE (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api new_type (unat arg1) \<le> 29) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 0x1D));
y <- whenE (new_type = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (new_type = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
node_cap <- if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of node_cap - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api new_type (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type new_type \<and> new_type \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api new_type (unat arg1))) new_type (unat arg1) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs) d)
odE) (doE y <- whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0));
y <- whenE (\<not> unat arg1 < wordBits) (throwError (Fault_H.syscall_error.RangeError 0 0x1D));
y <- whenE (29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) (throwError (Fault_H.syscall_error.RangeError 0 0x1D));
y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE;
y <- if isCNodeCap nodeCap then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits nodeCap - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits nodeCap - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - arg4)));
slots <- liftE (mapM (locateSlotCap nodeCap) [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ?Q33 s s' sa
 3. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ?Q'33 s s' sa proof (prove)
goal (5 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R37 s s' rv) (?R'37 s s' y) (doE y <- whenE (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 0x1D));
y <- whenE (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
node_cap <- if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of node_cap - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs) d)
odE) (doE y <- whenE (\<not> unat arg1 < wordBits) (throwError (Fault_H.syscall_error.RangeError 0 0x1D));
y <- whenE (29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) (throwError (Fault_H.syscall_error.RangeError 0 0x1D));
y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE;
y <- if isCNodeCap nodeCap then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits nodeCap - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits nodeCap - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - arg4)));
slots <- liftE (mapM (locateSlotCap nodeCap) [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>?R37 s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>?R'37 s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R37 s s' rv) (?R'37 s s' y) (doE y <- whenE (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 0x1D));
y <- whenE (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
node_cap <- if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of node_cap - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs) d)
odE) (doE y <- whenE (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) (throwError (Fault_H.syscall_error.RangeError 0 0x1D));
y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE;
y <- if isCNodeCap nodeCap then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits nodeCap - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits nodeCap - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - arg4)));
slots <- liftE (mapM (locateSlotCap nodeCap) [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>?R37 s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>?R'37 s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv\<rbrakk> \<Longrightarrow> ser (ExceptionTypes_A.syscall_error.RangeError 0 0x1D) (Fault_H.syscall_error.RangeError 0 0x1D)
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv\<rbrakk> \<Longrightarrow> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) = (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1))
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q47 s s' rv) (?Q'49 s s' y) (doE y <- whenE (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
node_cap <- if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of node_cap - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs) d)
odE) (doE y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE;
y <- if isCNodeCap nodeCap then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits nodeCap - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits nodeCap - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - arg4)));
slots <- liftE (mapM (locateSlotCap nodeCap) [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> ?Q47 s s' rv sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> ?Q'49 s s' y sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv\<rbrakk> \<Longrightarrow> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) = (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1))
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q47 s s' rv) (?Q'49 s s' y) (doE y <- whenE (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
node_cap <- if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of node_cap - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs) d)
odE) (doE y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE;
y <- if isCNodeCap nodeCap then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits nodeCap - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits nodeCap - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - arg4)));
slots <- liftE (mapM (locateSlotCap nodeCap) [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> ?Q47 s s' rv sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> ?Q'49 s s' y sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < 32; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x\<rbrakk> \<Longrightarrow> (unat arg1 < 32 \<longrightarrow> \<not> APIType_capBits (toEnum (unat arg0)) (unat arg1) \<le> 29) = (unat arg1 < 32 \<longrightarrow> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1))
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q47 s s' rv) (?Q'49 s s' y) (doE y <- whenE (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
node_cap <- if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of node_cap - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs) d)
odE) (doE y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE;
y <- if isCNodeCap nodeCap then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits nodeCap - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits nodeCap - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - arg4)));
slots <- liftE (mapM (locateSlotCap nodeCap) [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> ?Q47 s s' rv sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> ?Q'49 s s' y sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q47 s s' rv) (?Q'49 s s' y) (doE y <- whenE (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
node_cap <- if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of node_cap - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs) d)
odE) (doE y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE;
y <- if isCNodeCap nodeCap then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits nodeCap - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits nodeCap - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - arg4)));
slots <- liftE (mapM (locateSlotCap nodeCap) [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> ?Q47 s s' rv sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> ?Q'49 s s' y sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29)\<rbrakk> \<Longrightarrow> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) = (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0)
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q60 s s' rv) (?Q'62 s s' y) (doE y <- whenE (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
node_cap <- if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of node_cap - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs) d)
odE) (doE y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE;
y <- if isCNodeCap nodeCap then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits nodeCap - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits nodeCap - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - arg4)));
slots <- liftE (mapM (locateSlotCap nodeCap) [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> ?Q60 s s' rv sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> ?Q'62 s s' y sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q60 s s' rv) (?Q'62 s s' y) (doE y <- whenE (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
node_cap <- if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of node_cap - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs) d)
odE) (doE y <- whenE (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE;
y <- if isCNodeCap nodeCap then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits nodeCap - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits nodeCap - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - arg4)));
slots <- liftE (mapM (locateSlotCap nodeCap) [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> ?Q60 s s' rv sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> ?Q'62 s s' y sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0)\<rbrakk> \<Longrightarrow> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) = (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4)
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q74 s s' rv) (?Q'76 s s' y) (doE node_cap <- if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of node_cap - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs) d)
odE) (doE nodeCap <- if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE;
y <- if isCNodeCap nodeCap then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits nodeCap - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits nodeCap - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - arg4)));
slots <- liftE (mapM (locateSlotCap nodeCap) [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ?Q74 s s' rv sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ?Q'76 s s' y sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q74 s s' rv) (?Q'76 s s' y) (doE node_cap <- if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE;
y <- if is_cnode_cap node_cap then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of node_cap - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) xs) d)
odE) (doE nodeCap <- if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE;
y <- if isCNodeCap nodeCap then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits nodeCap - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits nodeCap - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - arg4)));
slots <- liftE (mapM (locateSlotCap nodeCap) [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ?Q74 s s' rv sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ?Q'76 s s' y sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cap_relation) (?P87 s s' rv) (?P'89 s s' y) (if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE) (if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R86 s s' rv y rva) (?R'86 s s' rv y rv') (doE y <- if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>?R86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>?R'86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> (?P87 s s' rv and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> (?P'89 s s' y and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cap_relation) (?P93 s s' rv) (?P'96 s s' y) (returnOk cap) (returnOk cap')
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cap_relation) (?Q94 s s' rv) (?Q'97 s s' y) (doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE) (doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R86 s s' rv y rva) (?R'86 s s' rv y rv') (doE y <- if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>?R86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>?R'86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then ?P93 s s' rv else ?Q94 s s' rv) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then ?P'96 s s' y else ?Q'97 s s' y) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> cap_relation cap cap'
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cap_relation) (?Q94 s s' rv) (?Q'97 s s' y) (doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE) (doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R86 s s' rv y rva) (?R'86 s s' rv y rv') (doE y <- if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>?R86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>?R'86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else ?Q94 s s' rv) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else ?Q'97 s s' y) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cap_relation) (?Q94 s s' rv) (?Q'97 s s' y) (doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE) (doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R86 s s' rv y rva) (?R'86 s s' rv y rv') (doE y <- if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>?R86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>?R'86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else ?Q94 s s' rv) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else ?Q'97 s s' y) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cap_relation) (?Q94 s s' rv) (?Q'97 s s' ()) (doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE) (doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R86 s s' rv y rva) (?R'86 s s' rv y rv') (doE y <- if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>?R86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>?R'86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else ?Q94 s s' rv) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else ?Q'97 s s' y) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (11 subgoals):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ?r'103 s s' rv) (?P103 s s' rv) (?P'108 s s' ()) (lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3)) (lookupSlotForCNodeOp False cap' arg2 (unat arg3))
 2. \<And>s s' rv node_slot nodeSlot. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; ?r'103 s s' rv node_slot nodeSlot\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cap_relation) (?R103 s s' rv node_slot) (?R'103 s s' rv nodeSlot) (liftE (get_cap node_slot)) (liftE (getSlotCap nodeSlot))
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> \<lbrace>?Q103 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>?R103 s s' rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'106 s s' ()\<rbrace> lookupSlotForCNodeOp False cap' arg2 (unat arg3) \<lbrace>?R'103 s s' rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R86 s s' rv y rva) (?R'86 s s' rv y rv') (doE y <- if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>?R86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>?R'86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else ?P103 s s' rv and ?Q103 s s' rv) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else ?P'108 s s' y and ?Q'106 s s' y) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> cap_relation cap cap'
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> to_bl arg2 = to_bl arg2
 3. \<And>s s' rv node_slot nodeSlot. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; nodeSlot = cte_map node_slot\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cap_relation) (?R103 s s' rv node_slot) (?R'103 s s' rv nodeSlot) (liftE (get_cap node_slot)) (liftE (getSlotCap nodeSlot))
 4. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> \<lbrace>?Q103 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>?R103 s s' rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'106 s s' ()\<rbrace> lookupSlotForCNodeOp False cap' arg2 (unat arg3) \<lbrace>?R'103 s s' rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R86 s s' rv y rva) (?R'86 s s' rv y rv') (doE y <- if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>?R86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>?R'86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and ?Q103 s s' rv) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and ?Q'106 s s' y) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> to_bl arg2 = to_bl arg2
 2. \<And>s s' rv node_slot nodeSlot. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; nodeSlot = cte_map node_slot\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cap_relation) (?R103 s s' rv node_slot) (?R'103 s s' rv nodeSlot) (liftE (get_cap node_slot)) (liftE (getSlotCap nodeSlot))
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> \<lbrace>?Q103 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>?R103 s s' rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'106 s s' ()\<rbrace> lookupSlotForCNodeOp False cap' arg2 (unat arg3) \<lbrace>?R'103 s s' rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R86 s s' rv y rva) (?R'86 s s' rv y rv') (doE y <- if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>?R86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>?R'86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and ?Q103 s s' rv) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and ?Q'106 s s' y) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s s' rv node_slot nodeSlot. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; nodeSlot = cte_map node_slot\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cap_relation) (?R103 s s' rv node_slot) (?R'103 s s' rv nodeSlot) (liftE (get_cap node_slot)) (liftE (getSlotCap nodeSlot))
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> \<lbrace>?Q103 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>?R103 s s' rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'106 s s' ()\<rbrace> lookupSlotForCNodeOp False cap' arg2 (unat arg3) \<lbrace>?R'103 s s' rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R86 s s' rv y rva) (?R'86 s s' rv y rv') (doE y <- if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>?R86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>?R'86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and ?Q103 s s' rv) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and ?Q'106 s s' y) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rv node_slot nodeSlot. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; nodeSlot = cte_map node_slot\<rbrakk> \<Longrightarrow> corres cap_relation (?R103 s s' rv node_slot) (?R'103 s s' rv (cte_map node_slot)) (get_cap node_slot) (getSlotCap (cte_map node_slot))
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> \<lbrace>?Q103 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>?R103 s s' rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'106 s s' ()\<rbrace> lookupSlotForCNodeOp False cap' arg2 (unat arg3) \<lbrace>?R'103 s s' rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R86 s s' rv y rva) (?R'86 s s' rv y rv') (doE y <- if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>?R86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>?R'86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and ?Q103 s s' rv) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and ?Q'106 s s' y) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> \<lbrace>?Q103 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>cte_wp_at (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'106 s s' ()\<rbrace> lookupSlotForCNodeOp False cap' arg2 (unat arg3) \<lbrace>\<lambda>a. pspace_distinct' and pspace_aligned'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R86 s s' rv y rva) (?R'86 s s' rv y rv') (doE y <- if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>?R86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>?R'86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and ?Q103 s s' rv) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and ?Q'106 s s' y) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R86 s s' rv y rva) (?R'86 s s' rv y rv') (doE y <- if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3)));
y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>?R86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>?R'86 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P136 s s' rv y rva) (?P'138 s s' rv y rv') (if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)))) (if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))))
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R135 s s' rv y rva rv') (?R'135 s s' rv y rva rv') (doE y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R'135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. ?P136 s s' rv y rva and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. ?P'138 s s' rv y rv' and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (12 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> is_cnode_cap rva = isCNodeCap rv'
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P142 s s' rv y rva) (?P'145 s s' rv y rv') (returnOk ()) (returnOk ())
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?Q143 s s' rv y rva) (?Q'146 s s' rv y rv') (throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)))) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))))
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R135 s s' rv y rva rv') (?R'135 s s' rv y rva rv') (doE y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R'135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else ?Q143 s s' rv y rva) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else ?Q'146 s s' rv y rv') and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P142 s s' rv y rva) (?P'145 s s' rv y rv') (returnOk ()) (returnOk ())
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?Q143 s s' rv y rva) (?Q'146 s s' rv y rv') (throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)))) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))))
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R135 s s' rv y rva rv') (?R'135 s s' rv y rva rv') (doE y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R'135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else ?Q143 s s' rv y rva) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else ?Q'146 s s' rv y rv') and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?Q143 s s' rv y rva) (?Q'146 s s' rv y rv') (throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)))) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))))
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R135 s s' rv y rva rv') (?R'135 s s' rv y rva rv') (doE y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R'135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else ?Q143 s s' rv y rva) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else ?Q'146 s s' rv y rv') and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (\<lambda>_. True) (\<lambda>_. True) (throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3)))) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))))
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R135 s s' rv y rva rv') (?R'135 s s' rv y rva rv') (doE y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R'135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R135 s s' rv y rva rv') (?R'135 s s' rv y rva rv') (doE y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R'135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?P154 s s' rv y rva rv') (?R'135 s s' rv y rva rv') (doE y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?P154 s s' rv y rva rv' and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R'135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?P154 s s' rv y rva rv') (?R'135 s s' rv y rva rv') (doE y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva\<rbrakk> \<Longrightarrow> is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?P154 s s' rv y rva rv' and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R'135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva\<rbrakk> \<Longrightarrow> is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?P154 s s' rv y rva rv') (?R'135 s s' rv y rva rv') (doE y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?P154 s s' rv y rva rv' and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R'135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?P154 s s' rv y rva rv') (?R'135 s s' rv y rva rv') (doE y <- whenE (2 ^ bits_of rva - Suc 0 < unat arg4) (throwError (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)));
y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (2 ^ capCNodeBits rv' - 1 < arg4) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1)));
y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?P154 s s' rv y rva rv' and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. ?R'135 s s' rv y rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (11 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32\<rbrakk> \<Longrightarrow> ser (ExceptionTypes_A.syscall_error.RangeError 0 (2 ^ bits_of rva - 1)) (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits rv' - 1))
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32\<rbrakk> \<Longrightarrow> (2 ^ bits_of rva - Suc 0 < unat arg4) = (2 ^ capCNodeBits rv' - 1 < arg4)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q168 s s' rv y rva rv') (?Q'168 s s' rv y rva rv') (doE y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> ?Q168 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> ?Q'168 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s s' r bits g. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r bits; bits < 32\<rbrakk> \<Longrightarrow> (2 ^ bits - Suc 0 < unat arg4) = (2 ^ bits - 1 < arg4)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q168 s s' rv y rva rv') (?Q'168 s s' rv y rva rv') (doE y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> ?Q168 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> ?Q'168 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q168 s s' rv y rva rv') (?Q'168 s s' rv y rva rv') (doE y <- whenE (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (arg5 = 0 \<or> retypeFanOutLimit < arg5) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> ?Q168 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> ?Q'168 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (11 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4\<rbrakk> \<Longrightarrow> ser (ExceptionTypes_A.syscall_error.RangeError 1 retypeFanOutLimit) (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4\<rbrakk> \<Longrightarrow> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) = (arg5 = 0 \<or> retypeFanOutLimit < arg5)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q197 s s' rv y rva rv') (?Q'197 s s' rv y rva rv') (doE y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> ?Q197 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> ?Q'197 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s s' r bits g. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits - Suc 0 < unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r bits; bits < 32\<rbrakk> \<Longrightarrow> (unat arg5 = 0 \<or> 256 < unat arg5) = (arg5 = 0 \<or> 0x100 < arg5)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q197 s s' rv y rva rv') (?Q'197 s s' rv y rva rv') (doE y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> ?Q197 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> ?Q'197 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q197 s s' rv y rva rv') (?Q'197 s s' rv y rva rv') (doE y <- whenE (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) (throwError (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4)));
slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> ?Q197 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> ?Q'197 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (11 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5)\<rbrakk> \<Longrightarrow> ser (ExceptionTypes_A.syscall_error.RangeError 1 (word_of_nat (2 ^ bits_of rva - unat arg4))) (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits rv' - arg4))
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5)\<rbrakk> \<Longrightarrow> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) = (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5); \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' rv y rva rv') (?Q'214 s s' rv y rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s s' r bits g. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits - Suc 0 < unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r bits; bits < 32; 0 < unat arg5; \<not> 256 < unat arg5\<rbrakk> \<Longrightarrow> (2 ^ bits - unat arg4 < unat arg5) = (arg5 = 0 \<or> 2 ^ bits - arg4 < arg5)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5); \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' rv y rva rv') (?Q'214 s s' rv y rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' r bits. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits - Suc 0 < unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_aligned r bits; bits < 32; 0 < unat arg5; \<not> 256 < unat arg5; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < word_bits\<rbrakk> \<Longrightarrow> (2 ^ bits - unat arg4 < unat arg5) = (arg5 = 0 \<or> unat (2 ^ bits - arg4) < unat arg5)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5); \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' rv y rva rv') (?Q'214 s s' rv y rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (11 subgoals):
 1. \<And>s s' r bits. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits - Suc 0 < unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_aligned r bits; bits < 32; 0 < unat arg5; \<not> 256 < unat arg5; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < word_bits\<rbrakk> \<Longrightarrow> arg4 \<le> 2 ^ bits
 2. \<And>s s' r bits. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits - Suc 0 < unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_aligned r bits; bits < 32; 0 < unat arg5; \<not> 256 < unat arg5; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < word_bits\<rbrakk> \<Longrightarrow> (2 ^ bits - unat arg4 < unat arg5) = (arg5 = 0 \<or> unat (2 ^ bits) - unat arg4 < unat arg5)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5); \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' rv y rva rv') (?Q'214 s s' rv y rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s s' r bits. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits - Suc 0 < unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_aligned r bits; bits < 32; 0 < unat arg5; \<not> 256 < unat arg5; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < word_bits\<rbrakk> \<Longrightarrow> (2 ^ bits - unat arg4 < unat arg5) = (arg5 = 0 \<or> unat (2 ^ bits) - unat arg4 < unat arg5)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5); \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' rv y rva rv') (?Q'214 s s' rv y rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' r bits. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat arg1 \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits - Suc 0 < unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_aligned r bits; bits < 32; unat arg5 \<noteq> 0; \<not> 256 < unat arg5; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < word_bits\<rbrakk> \<Longrightarrow> (2 ^ bits - unat arg4 < unat arg5) = (arg5 = 0 \<or> unat (2 ^ bits) - unat arg4 < unat arg5)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5); \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' rv y rva rv') (?Q'214 s s' rv y rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'; is_cnode_cap rva \<and> cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva) \<and> bits_of rva < 32; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5); \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' rv y rva rv') (?Q'214 s s' rv y rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api rv (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> is_frame_type rv \<and> rv \<noteq> Structures_A.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api rv (unat arg1))) rv (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE slots <- liftE (mapM (locateSlotCap rv') [arg4 .e. arg4 + arg5 - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) slots d)
odE)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (do y <- stateAssert (\<lambda>s. case gsCNodes s (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n) [];
doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE
od)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (do y <- stateAssert (\<lambda>s. case gsCNodes s (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n) [];
doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE
od)
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5\<rbrakk> \<Longrightarrow> unat (arg4 + arg5) = unat arg4 + unat arg5
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5\<rbrakk> \<Longrightarrow> unat (arg4 + arg5) = unat arg4 + unat arg5
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (do y <- stateAssert (\<lambda>s. case gsCNodes s (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n) [];
doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE
od)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; cap_relation rva rv'; unat arg4 \<le> 2 ^ bits_of rva - Suc 0; unat arg5 \<le> 2 ^ bits_of rva - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit\<rbrakk> \<Longrightarrow> unat (arg4 + arg5) = unat arg4 + unat arg5
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (do y <- stateAssert (\<lambda>s. case gsCNodes s (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n) [];
doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE
od)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; cap_relation rva rv'; unat arg4 \<le> 2 ^ bits_of rva - Suc 0; unat arg5 \<le> 2 ^ bits_of rva - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit\<rbrakk> \<Longrightarrow> (unat arg4 + unat arg5) mod 2 ^ LENGTH(32) = unat arg4 + unat arg5
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (do y <- stateAssert (\<lambda>s. case gsCNodes s (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n) [];
doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE
od)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; cap_relation rva rv'; unat arg4 \<le> 2 ^ bits_of rva - Suc 0; unat arg5 \<le> 2 ^ bits_of rva - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit\<rbrakk> \<Longrightarrow> unat arg4 + unat arg5 < 2 ^ LENGTH(32)
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (do y <- stateAssert (\<lambda>s. case gsCNodes s (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n) [];
doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE
od)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; cap_relation rva rv'; unat arg4 \<le> 2 ^ bits_of rva - Suc 0; unat arg5 \<le> 2 ^ bits_of rva - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit\<rbrakk> \<Longrightarrow> unat arg4 + unat arg5 < 2 ^ word_bits
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (do y <- stateAssert (\<lambda>s. case gsCNodes s (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n) [];
doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE
od)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (11 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; cap_relation rva rv'; unat arg4 \<le> 2 ^ bits_of rva - Suc 0; unat arg5 \<le> 2 ^ bits_of rva - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit; 2 ^ bits_of rva < 2 ^ word_bits\<rbrakk> \<Longrightarrow> unat arg4 + unat arg5 < 2 ^ word_bits
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; cap_relation rva rv'; unat arg4 \<le> 2 ^ bits_of rva - Suc 0; unat arg5 \<le> 2 ^ bits_of rva - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit\<rbrakk> \<Longrightarrow> 2 ^ bits_of rva < 2 ^ word_bits
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (do y <- stateAssert (\<lambda>s. case gsCNodes s (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n) [];
doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE
od)
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; cap_relation rva rv'; unat arg4 \<le> 2 ^ bits_of rva - Suc 0; unat arg5 \<le> 2 ^ bits_of rva - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit\<rbrakk> \<Longrightarrow> 2 ^ bits_of rva < 2 ^ word_bits
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (do y <- stateAssert (\<lambda>s. case gsCNodes s (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n) [];
doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE
od)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; cap_relation rva rv'; unat arg4 \<le> 2 ^ bits_of rva - Suc 0; unat arg5 \<le> 2 ^ bits_of rva - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit\<rbrakk> \<Longrightarrow> 1 < 2
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (do y <- stateAssert (\<lambda>s. case gsCNodes s (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n) [];
doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE
od)
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (do y <- stateAssert (\<lambda>s. case gsCNodes s (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n) [];
doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE
od)
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ?Q214 s s' rv y rva rv' sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE)
 2. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' sa; sa \<turnstile> rva; ?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> (?P506 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (14 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> Suc (unat arg4 + unat arg5 - Suc 0) \<le> 2 ^ bits_of rva
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> bits_of rva < 32
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> 1 \<le> arg4 + arg5
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> arg4 \<le> arg4 + arg5
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map cte_map (map (Pair (obj_ref_of rva)) (map (nat_to_cref (bits_of rva)) xs))\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE)
 6. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' sa; sa \<turnstile> rva; ?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> (?P506 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> bits_of rva < 32
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> 1 \<le> arg4 + arg5
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> arg4 \<le> arg4 + arg5
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map cte_map (map (Pair (obj_ref_of rva)) (map (nat_to_cref (bits_of rva)) xs))\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE)
 5. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' sa; sa \<turnstile> rva; ?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> (?P506 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> 1 \<le> arg4 + arg5
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> arg4 \<le> arg4 + arg5
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map cte_map (map (Pair (obj_ref_of rva)) (map (nat_to_cref (bits_of rva)) xs))\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE)
 4. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' sa; sa \<turnstile> rva; ?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> (?P506 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> arg4 \<le> arg4 + arg5
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map cte_map (map (Pair (obj_ref_of rva)) (map (nat_to_cref (bits_of rva)) xs))\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE)
 3. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' sa; sa \<turnstile> rva; ?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> (?P506 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map cte_map (map (Pair (obj_ref_of rva)) (map (nat_to_cref (bits_of rva)) xs))\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od
odE) (doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od
odE)
 2. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' sa; sa \<turnstile> rva; ?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> (?P506 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (doE y <- mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]);
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 2. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ?P506 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' sa; sa \<turnstile> rva; ?Q'214 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> (?P506 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> ?Q'214 s s' rv y rva rv' sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (13 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P687 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (?P'685 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') (mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs)) (mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]))
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; (?P687 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (?P'685 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> (?P687 s s' rv y rva rv' and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (?P'685 s s' rv y rva rv' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s s' r bits g. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P687 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () (cap.CNodeCap r bits g) (capability.CNodeCap r bits (of_bl g) (length g))) (?P'685 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () (cap.CNodeCap r bits g) (capability.CNodeCap r bits (of_bl g) (length g))) (mapME_x ensure_empty (map (\<lambda>a. (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) a)) xs)) (mapME_x ensureEmptySlot (map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs))
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; (?P687 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (?P'685 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> (?P687 s s' rv y rva rv' and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (?P'685 s s' rv y rva rv' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s s' r bits g. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P687 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () (cap.CNodeCap r bits g) (capability.CNodeCap r bits (of_bl g) (length g))) (?P'685 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () (cap.CNodeCap r bits g) (capability.CNodeCap r bits (of_bl g) (length g))) (mapME_x (ensure_empty \<circ> (\<lambda>a. (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) a))) xs) (mapME_x (ensureEmptySlot \<circ> (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g))))) xs)
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; (?P687 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (?P'685 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> (?P687 s s' rv y rva rv' and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (?P'685 s s' rv y rva rv' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s s' r bits g. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?Q699 s s' r bits g) (?Q'699 s s' r bits g) (mapME_x (ensure_empty \<circ> (\<lambda>a. (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) a))) xs) (mapME_x (ensureEmptySlot \<circ> (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g))))) xs)
 2. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; (valid_cap (cap.CNodeCap r bits g) and invs) sa\<rbrakk> \<Longrightarrow> ?Q699 s s' r bits g sa
 3. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; invs' sa\<rbrakk> \<Longrightarrow> ?Q'699 s s' r bits g sa
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s s' r bits g x. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P703 s s' r bits g x) (?P'703 s s' r bits g x) ((ensure_empty \<circ> (\<lambda>a. (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) a))) x) ((ensureEmptySlot \<circ> (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g))))) x)
 2. \<And>s s' r bits g x P. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> (ensure_empty \<circ> (\<lambda>a. (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) a))) x \<lbrace>\<lambda>x. P\<rbrace>, -
 3. \<And>s s' r bits g x P'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> \<lbrace>P'\<rbrace> (ensureEmptySlot \<circ> (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g))))) x \<lbrace>\<lambda>x. P'\<rbrace>, -
 4. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; (valid_cap (cap.CNodeCap r bits g) and invs) sa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. ?P703 s s' r bits g x sa
 5. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; invs' sa\<rbrakk> \<Longrightarrow> \<forall>y\<in>set xs. ?P'703 s s' r bits g y sa
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 7. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 10. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s s' r bits g x. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P703 s s' r bits g x) (?P'703 s s' r bits g x) (ensure_empty (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) x)) (ensureEmptySlot (cte_map (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) x)))
 2. \<And>s s' r bits g x P. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> (ensure_empty \<circ> (\<lambda>a. (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) a))) x \<lbrace>\<lambda>x. P\<rbrace>, -
 3. \<And>s s' r bits g x P'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> \<lbrace>P'\<rbrace> (ensureEmptySlot \<circ> (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g))))) x \<lbrace>\<lambda>x. P'\<rbrace>, -
 4. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; (valid_cap (cap.CNodeCap r bits g) and invs) sa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. ?P703 s s' r bits g x sa
 5. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; invs' sa\<rbrakk> \<Longrightarrow> \<forall>y\<in>set xs. ?P'703 s s' r bits g y sa
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 7. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 10. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s s' r bits g x. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> cte_map (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) x) = cte_map (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) x)
 2. \<And>s s' r bits g x P. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> (ensure_empty \<circ> (\<lambda>a. (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) a))) x \<lbrace>\<lambda>x. P\<rbrace>, -
 3. \<And>s s' r bits g x P'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> \<lbrace>P'\<rbrace> (ensureEmptySlot \<circ> (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g))))) x \<lbrace>\<lambda>x. P'\<rbrace>, -
 4. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; (valid_cap (cap.CNodeCap r bits g) and invs) sa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (invs and cte_wp_at (\<lambda>_. True) (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) x)) sa
 5. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; invs' sa\<rbrakk> \<Longrightarrow> \<forall>y\<in>set xs. invs' sa
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 7. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 10. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s s' r bits g x P. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> (ensure_empty \<circ> (\<lambda>a. (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) a))) x \<lbrace>\<lambda>x. P\<rbrace>, -
 2. \<And>s s' r bits g x P'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> \<lbrace>P'\<rbrace> (ensureEmptySlot \<circ> (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g))))) x \<lbrace>\<lambda>x. P'\<rbrace>, -
 3. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; (valid_cap (cap.CNodeCap r bits g) and invs) sa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (invs and cte_wp_at (\<lambda>_. True) (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) x)) sa
 4. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; invs' sa\<rbrakk> \<Longrightarrow> \<forall>y\<in>set xs. invs' sa
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 9. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s s' r bits g x P'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs\<rbrakk> \<Longrightarrow> \<lbrace>P'\<rbrace> (ensureEmptySlot \<circ> (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g))))) x \<lbrace>\<lambda>x. P'\<rbrace>, -
 2. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; (valid_cap (cap.CNodeCap r bits g) and invs) sa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (invs and cte_wp_at (\<lambda>_. True) (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) x)) sa
 3. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; invs' sa\<rbrakk> \<Longrightarrow> \<forall>y\<in>set xs. invs' sa
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s s' r bits g x P' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; P' sa\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) x)) sa \<longrightarrow> P' sa
 2. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; (valid_cap (cap.CNodeCap r bits g) and invs) sa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (invs and cte_wp_at (\<lambda>_. True) (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) x)) sa
 3. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; invs' sa\<rbrakk> \<Longrightarrow> \<forall>y\<in>set xs. invs' sa
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; (valid_cap (cap.CNodeCap r bits g) and invs) sa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (invs and cte_wp_at (\<lambda>_. True) (r, nat_to_cref (bits_of (cap.CNodeCap r bits g)) x)) sa
 2. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; invs' sa\<rbrakk> \<Longrightarrow> \<forall>y\<in>set xs. invs' sa
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s s' r bits g sa x. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits - Suc 0 < unat arg4; \<not> 2 ^ bits - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; \<forall>x\<in>set csmore. cap_aligned x \<and> (case x of cap.UntypedCap dev p b f \<Rightarrow> valid_untyped x s \<and> untyped_min_bits \<le> b \<and> f \<le> 2 ^ b \<and> p \<noteq> 0 | cap.EndpointCap r badge rights \<Rightarrow> ep_at r s | cap.NotificationCap r badge rights \<Rightarrow> ntfn_at r s \<and> AllowGrant \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.ReplyCap r m rights \<Rightarrow> tcb_at r s \<and> AllowWrite \<in> rights \<and> AllowRead \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.CNodeCap r bits guard \<Rightarrow> cap_table_at bits r s \<and> bits \<noteq> 0 \<and> length guard \<le> word_bits | cap.ThreadCap r \<Rightarrow> tcb_at r s | cap.IRQHandlerCap irq \<Rightarrow> irq \<le> maxIRQ | cap.Zombie r None n \<Rightarrow> tcb_at r s \<and> n \<le> 5 | cap.Zombie r (Some ba) n \<Rightarrow> cap_table_at ba r s \<and> n \<le> 2 ^ ba \<and> ba \<noteq> 0 | cap.ArchObjectCap (arch_cap.ASIDPoolCap r as) \<Rightarrow> typ_at (AArch AASIDPool) r s \<and> is_aligned as local.asid_low_bits \<and> as \<le> 2 ^ local.asid_bits - 1 | cap.ArchObjectCap arch_cap.ASIDControlCap \<Rightarrow> True | cap.ArchObjectCap (arch_cap.PageCap dev r rghts sz mapdata) \<Rightarrow> (if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s) \<and> rghts \<in> valid_vm_rights \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned ref sz \<and> ref < kernel_base) | cap.ArchObjectCap (arch_cap.PageTableCap r mapdata) \<Rightarrow> typ_at (AArch APageTable) r s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, vref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vref < kernel_base \<and> is_aligned vref (pageBitsForSize ARMSection)) | cap.ArchObjectCap (arch_cap.PageDirectoryCap r mapdata) \<Rightarrow> typ_at (AArch APageDirectory) r s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | _ \<Rightarrow> True); unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r bits; bits < 32; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref bits)) [unat arg4..<unat arg4 + unat arg5]; cap_aligned cap; case cap of cap.UntypedCap dev p b f \<Rightarrow> valid_untyped cap s \<and> untyped_min_bits \<le> b \<and> f \<le> 2 ^ b \<and> p \<noteq> 0 | cap.EndpointCap r badge rights \<Rightarrow> ep_at r s | cap.NotificationCap r badge rights \<Rightarrow> ntfn_at r s \<and> AllowGrant \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.ReplyCap r m rights \<Rightarrow> tcb_at r s \<and> AllowWrite \<in> rights \<and> AllowRead \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.CNodeCap r bits guard \<Rightarrow> cap_table_at bits r s \<and> bits \<noteq> 0 \<and> length guard \<le> word_bits | cap.ThreadCap r \<Rightarrow> tcb_at r s | cap.IRQHandlerCap irq \<Rightarrow> irq \<le> maxIRQ | cap.Zombie r None n \<Rightarrow> tcb_at r s \<and> n \<le> 5 | cap.Zombie r (Some ba) n \<Rightarrow> cap_table_at ba r s \<and> n \<le> 2 ^ ba \<and> ba \<noteq> 0 | cap.ArchObjectCap (arch_cap.ASIDPoolCap r as) \<Rightarrow> typ_at (AArch AASIDPool) r s \<and> is_aligned as local.asid_low_bits \<and> as \<le> 2 ^ local.asid_bits - 1 | cap.ArchObjectCap arch_cap.ASIDControlCap \<Rightarrow> True | cap.ArchObjectCap (arch_cap.PageCap dev r rghts sz mapdata) \<Rightarrow> (if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s) \<and> rghts \<in> valid_vm_rights \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned ref sz \<and> ref < kernel_base) | cap.ArchObjectCap (arch_cap.PageTableCap r mapdata) \<Rightarrow> typ_at (AArch APageTable) r s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, vref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vref < kernel_base \<and> is_aligned vref (pageBitsForSize ARMSection)) | cap.ArchObjectCap (arch_cap.PageDirectoryCap r mapdata) \<Rightarrow> typ_at (AArch APageDirectory) r s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | _ \<Rightarrow> True; cap_table_at bits r sa; 0 < bits; length g \<le> word_bits; invs sa; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (r, nat_to_cref bits x) sa
 2. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; invs' sa\<rbrakk> \<Longrightarrow> \<forall>y\<in>set xs. invs' sa
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s s' r bits g sa x. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits - Suc 0 < unat arg4; \<not> 2 ^ bits - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; \<forall>x\<in>set csmore. cap_aligned x \<and> (case x of cap.UntypedCap dev p b f \<Rightarrow> valid_untyped x s \<and> untyped_min_bits \<le> b \<and> f \<le> 2 ^ b \<and> p \<noteq> 0 | cap.EndpointCap r badge rights \<Rightarrow> ep_at r s | cap.NotificationCap r badge rights \<Rightarrow> ntfn_at r s \<and> AllowGrant \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.ReplyCap r m rights \<Rightarrow> tcb_at r s \<and> AllowWrite \<in> rights \<and> AllowRead \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.CNodeCap r bits guard \<Rightarrow> cap_table_at bits r s \<and> bits \<noteq> 0 \<and> length guard \<le> word_bits | cap.ThreadCap r \<Rightarrow> tcb_at r s | cap.IRQHandlerCap irq \<Rightarrow> irq \<le> maxIRQ | cap.Zombie r None n \<Rightarrow> tcb_at r s \<and> n \<le> 5 | cap.Zombie r (Some ba) n \<Rightarrow> cap_table_at ba r s \<and> n \<le> 2 ^ ba \<and> ba \<noteq> 0 | cap.ArchObjectCap (arch_cap.ASIDPoolCap r as) \<Rightarrow> typ_at (AArch AASIDPool) r s \<and> is_aligned as local.asid_low_bits \<and> as \<le> 2 ^ local.asid_bits - 1 | cap.ArchObjectCap arch_cap.ASIDControlCap \<Rightarrow> True | cap.ArchObjectCap (arch_cap.PageCap dev r rghts sz mapdata) \<Rightarrow> (if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s) \<and> rghts \<in> valid_vm_rights \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned ref sz \<and> ref < kernel_base) | cap.ArchObjectCap (arch_cap.PageTableCap r mapdata) \<Rightarrow> typ_at (AArch APageTable) r s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, vref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vref < kernel_base \<and> is_aligned vref (pageBitsForSize ARMSection)) | cap.ArchObjectCap (arch_cap.PageDirectoryCap r mapdata) \<Rightarrow> typ_at (AArch APageDirectory) r s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | _ \<Rightarrow> True); unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r bits; bits < 32; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref bits)) [unat arg4..<unat arg4 + unat arg5]; cap_aligned cap; case cap of cap.UntypedCap dev p b f \<Rightarrow> valid_untyped cap s \<and> untyped_min_bits \<le> b \<and> f \<le> 2 ^ b \<and> p \<noteq> 0 | cap.EndpointCap r badge rights \<Rightarrow> ep_at r s | cap.NotificationCap r badge rights \<Rightarrow> ntfn_at r s \<and> AllowGrant \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.ReplyCap r m rights \<Rightarrow> tcb_at r s \<and> AllowWrite \<in> rights \<and> AllowRead \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.CNodeCap r bits guard \<Rightarrow> cap_table_at bits r s \<and> bits \<noteq> 0 \<and> length guard \<le> word_bits | cap.ThreadCap r \<Rightarrow> tcb_at r s | cap.IRQHandlerCap irq \<Rightarrow> irq \<le> maxIRQ | cap.Zombie r None n \<Rightarrow> tcb_at r s \<and> n \<le> 5 | cap.Zombie r (Some ba) n \<Rightarrow> cap_table_at ba r s \<and> n \<le> 2 ^ ba \<and> ba \<noteq> 0 | cap.ArchObjectCap (arch_cap.ASIDPoolCap r as) \<Rightarrow> typ_at (AArch AASIDPool) r s \<and> is_aligned as local.asid_low_bits \<and> as \<le> 2 ^ local.asid_bits - 1 | cap.ArchObjectCap arch_cap.ASIDControlCap \<Rightarrow> True | cap.ArchObjectCap (arch_cap.PageCap dev r rghts sz mapdata) \<Rightarrow> (if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s) \<and> rghts \<in> valid_vm_rights \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned ref sz \<and> ref < kernel_base) | cap.ArchObjectCap (arch_cap.PageTableCap r mapdata) \<Rightarrow> typ_at (AArch APageTable) r s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, vref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vref < kernel_base \<and> is_aligned vref (pageBitsForSize ARMSection)) | cap.ArchObjectCap (arch_cap.PageDirectoryCap r mapdata) \<Rightarrow> typ_at (AArch APageDirectory) r s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | _ \<Rightarrow> True; 0 < bits; length g \<le> word_bits; invs sa; unat arg4 \<le> x; x < unat arg4 + unat arg5\<rbrakk> \<Longrightarrow> length (nat_to_cref bits x) = bits
 2. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; invs' sa\<rbrakk> \<Longrightarrow> \<forall>y\<in>set xs. invs' sa
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s s' r bits g sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - Suc 0 < unat arg4; \<not> 2 ^ bits_of (cap.CNodeCap r bits g) - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r (bits_of (cap.CNodeCap r bits g)); bits_of (cap.CNodeCap r bits g) < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. r + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair r \<circ> nat_to_cref (bits_of (cap.CNodeCap r bits g)))) xs; invs' sa\<rbrakk> \<Longrightarrow> \<forall>y\<in>set xs. invs' sa
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R679 s s' rva rv') (?R'679 s s' rva rv') (doE reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE reset <- liftE (constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'679 s s' rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv') (?R'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv') (do reset <- const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE);
doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE
od) (do reset <- constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE);
doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE
od)
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. ?R733 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. ?R'733 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?R'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?R'733 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'
\<lambda>s s' rva rv'. ?R736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?R733 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' proof (prove)
goal (14 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R738 s s' rva rv' reset) (?R'738 s s' rva rv' reset) (doE y <- whenE (unat (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap d w n idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if reset then 0 else free_index_of (cap.UntypedCap d w n idx))) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>?R738 s s' rva rv'\<rbrace>
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>?R'738 s s' rva rv'\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (14 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?R738 s s' rva rv' reset) (?R'738 s s' rva rv' reset) (doE y <- whenE (unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if_res reset))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if_res reset)) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - if_res reset))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if_res reset)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>?R738 s s' rva rv'\<rbrace>
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>?R'738 s s' rva rv'\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (14 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?P751 s s' rva rv' reset) (?R'738 s s' rva rv' reset) (doE y <- whenE (unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) (throwError (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if_res reset))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if_res reset)) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - if_res reset))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if_res reset)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset. ?P751 s s' rva rv' reset and (\<lambda>s. if_res reset \<le> 2 ^ n)\<rbrace>
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>?R'738 s s' rva rv'\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (16 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n\<rbrakk> \<Longrightarrow> ser (ExceptionTypes_A.syscall_error.NotEnoughMemory (2 ^ n - word_of_nat (if_res reset))) (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) n - if_res reset)))
 2. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n\<rbrakk> \<Longrightarrow> (unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5) = (word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5)
 3. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q752 s s' rva rv' reset) (?Q'752 s s' rva rv' reset) (doE y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if_res reset)) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if_res reset)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset. (\<lambda>sa. \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5 \<longrightarrow> ?Q752 s s' rva rv' reset sa) and (\<lambda>s. if_res reset \<le> 2 ^ n)\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset sa. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> ?Q'752 s s' rva rv' reset sa\<rbrace>
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 9. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (15 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n\<rbrakk> \<Longrightarrow> (unat (2 ^ n - word_of_nat (if_res reset)) div 2 ^ obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) < unat arg5) = (unat (word_of_nat (shiftR (2 ^ n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1)))) < unat arg5)
 2. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q752 s s' rva rv' reset) (?Q'752 s s' rva rv' reset) (doE y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if_res reset)) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if_res reset)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset. (\<lambda>sa. \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5 \<longrightarrow> ?Q752 s s' rva rv' reset sa) and (\<lambda>s. if_res reset \<le> 2 ^ n)\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset sa. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> ?Q'752 s s' rva rv' reset sa\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (15 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n\<rbrakk> \<Longrightarrow> (unat (word_of_nat (2 ^ n - unat (word_of_nat (if_res reset)))) div 2 ^ obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) < unat arg5) = (unat (word_of_nat (shiftR (2 ^ n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1)))) < unat arg5)
 2. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q752 s s' rva rv' reset) (?Q'752 s s' rva rv' reset) (doE y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if_res reset)) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if_res reset)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset. (\<lambda>sa. \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5 \<longrightarrow> ?Q752 s s' rva rv' reset sa) and (\<lambda>s. if_res reset \<le> 2 ^ n)\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset sa. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> ?Q'752 s s' rva rv' reset sa\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (16 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> 2 ^ n < 2 ^ word_bits
 2. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; unat (word_of_nat (if_res reset)) = if_res reset\<rbrakk> \<Longrightarrow> (unat (word_of_nat (2 ^ n - unat (word_of_nat (if_res reset)))) div 2 ^ obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) < unat arg5) = (unat (word_of_nat (shiftR (2 ^ n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1)))) < unat arg5)
 3. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q752 s s' rva rv' reset) (?Q'752 s s' rva rv' reset) (doE y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if_res reset)) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if_res reset)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset. (\<lambda>sa. \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5 \<longrightarrow> ?Q752 s s' rva rv' reset sa) and (\<lambda>s. if_res reset \<le> 2 ^ n)\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset sa. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> ?Q'752 s s' rva rv' reset sa\<rbrace>
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 9. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (15 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; APIType_capBits (toEnum (unat arg0)) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; unat (word_of_nat (if_res reset)) = if_res reset\<rbrakk> \<Longrightarrow> (unat (word_of_nat (2 ^ n - if_res reset)) div 2 ^ APIType_capBits (toEnum (unat arg0)) (unat arg1) < unat arg5) = (unat (word_of_nat ((2 ^ n - if_res reset) div 2 ^ APIType_capBits (toEnum (unat arg0)) (unat arg1))) < unat arg5)
 2. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q752 s s' rva rv' reset) (?Q'752 s s' rva rv' reset) (doE y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if_res reset)) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if_res reset)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset. (\<lambda>sa. \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5 \<longrightarrow> ?Q752 s s' rva rv' reset sa) and (\<lambda>s. if_res reset \<le> 2 ^ n)\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset sa. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> ?Q'752 s s' rva rv' reset sa\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (14 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q752 s s' rva rv' reset) (?Q'752 s s' rva rv' reset) (doE y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if_res reset)) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)
odE) (doE y <- whenE (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if_res reset)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
odE)
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset. (\<lambda>sa. \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5 \<longrightarrow> ?Q752 s s' rva rv' reset sa) and (\<lambda>s. if_res reset \<le> 2 ^ n)\<rbrace>
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset sa. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> ?Q'752 s s' rva rv' reset sa\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (16 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5\<rbrakk> \<Longrightarrow> ser (ExceptionTypes_A.syscall_error.InvalidArgument (Suc 0)) (Fault_H.syscall_error.InvalidArgument (Suc 0))
 2. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5\<rbrakk> \<Longrightarrow> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) = (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped)
 3. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5; \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q761 s s' rva rv' reset) (?Q'761 s s' rva rv' reset) (returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if_res reset)) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)) (returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if_res reset)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d))
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset. (\<lambda>sa. \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5 \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> ?Q761 s s' rva rv' reset sa) and (\<lambda>s. if_res reset \<le> 2 ^ n)\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset sa. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> ?Q'761 s s' rva rv' reset sa\<rbrace>
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 9. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (15 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5\<rbrakk> \<Longrightarrow> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) = (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped)
 2. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5; \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q761 s s' rva rv' reset) (?Q'761 s s' rva rv' reset) (returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if_res reset)) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)) (returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if_res reset)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d))
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset. (\<lambda>sa. \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5 \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> ?Q761 s s' rva rv' reset sa) and (\<lambda>s. if_res reset \<le> 2 ^ n)\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset sa. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> ?Q'761 s s' rva rv' reset sa\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (14 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5; \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped)\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (?Q761 s s' rva rv' reset) (?Q'761 s s' rva rv' reset) (returnOk (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if_res reset)) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d)) (returnOk (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if_res reset)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d))
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset. (\<lambda>sa. \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5 \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> ?Q761 s s' rva rv' reset sa) and (\<lambda>s. if_res reset \<le> 2 ^ n)\<rbrace>
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset sa. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> ?Q'761 s s' rva rv' reset sa\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (14 subgoals):
 1. \<And>s s' rva rv' reset. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs; if_res reset \<le> 2 ^ n; \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5; \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped)\<rbrakk> \<Longrightarrow> untypinv_relation (Invocations_A.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (get_free_ref w (if_res reset)) (obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1))) (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) d) (Invocations_H.untyped_invocation.Retype (cte_map slot) reset w (More_Word_Operations.alignUp (getFreeRef w (if_res reset)) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) (toEnum (unat arg0)) (unat arg1) (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) d)
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset. (\<lambda>s. \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5 \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> True) and (\<lambda>s. if_res reset \<le> 2 ^ n)\<rbrace>
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset s. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> True\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (13 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset. (\<lambda>s. \<not> unat (2 ^ n - word_of_nat (if_res reset) >> obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1)) < unat arg5 \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> True) and (\<lambda>s. if_res reset \<le> 2 ^ n)\<rbrace>
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset s. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> True\<rbrace>
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (13 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE) \<lbrace>\<lambda>reset a. if_res reset \<le> 2 ^ n\<rbrace>
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset s. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> True\<rbrace>
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q747 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q746 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (12 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset s. \<not> word_of_nat (shiftR (shiftL (Suc 0) n - if_res reset) (APIType_capBits (toEnum (unat arg0)) (unat arg1))) < arg5 \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat arg0)) \<and> toEnum (unat arg0) \<noteq> APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> True\<rbrace>
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (12 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv'\<rbrace> constOnFailure False (doE y <- ensureNoChildren (cte_map slot);
returnOk True
odE) \<lbrace>\<lambda>reset s. True\<rbrace>
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>s s' rva rv'. ?Q'745 s s' rva rv' (?s733 s s' rva rv') (?s'733 s s' rva rv') rva rv' \<equiv>\<^sup>? \<lambda>s s' rva rv'. ?Q'744 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv' (?s736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') (?s'736 s s' rva rv' (?sa736 s s' rva rv') (?s'a736 s s' rva rv') rva rv') rva rv' proof (prove)
goal (11 subgoals):
 1. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensure_empty (map (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva)) xs) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s s' rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; map (\<lambda>x. obj_ref_of rva + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1] = map (cte_map \<circ> (Pair (obj_ref_of rva) \<circ> nat_to_cref (bits_of rva))) xs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv'\<rbrace> mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr rv' + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1]) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') sa; sa \<turnstile> rva; (invs' and ?Q'684 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) () rva rv') s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>sa. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and ?Q686 s s' rv y rva rv' and (\<lambda>a. a \<turnstile> rva)) sa) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x sa. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and ?Q'684 s s' rv y rva rv') sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>s s' rva rv' sa s'a. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; cap_relation rva rv'; \<not> 2 ^ bits_of rva - Suc 0 < unat arg4; \<not> 2 ^ bits_of rva - unat arg4 < unat arg5; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; is_cnode_cap rva; cap_aligned rva; is_aligned (obj_ref_of rva) (bits_of rva); bits_of rva < 32; 0 < unat arg5; \<not> unat retypeFanOutLimit < unat arg5; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; ((\<lambda>a. a \<turnstile> rva) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx)))) sa; sa \<turnstile> rva; (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s'a\<rbrakk> \<Longrightarrow> case gsCNodes s'a (global.capUntypedPtr rv') of None \<Rightarrow> [arg4 .e. arg4 + arg5 - 1] = [] | Some n \<Rightarrow> \<forall>x. arg4 \<le> x \<and> x \<le> arg4 + arg5 - 1 \<longrightarrow> n = capCNodeBits rv' \<and> x < 2 ^ n
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>s. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> rva)) s) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x s. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' sa s'a r bits g da x xa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; unat arg4 \<le> 2 ^ bits - Suc 0; unat arg5 \<le> 2 ^ bits - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r bits; bits < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; invs sa; invs' s'a; cte_wp_at (\<lambda>_. True) slot sa; pspace_aligned' s'a; cap_aligned (cap.UntypedCap da w n idx); pspace_distinct' s'a; untyped_min_bits \<le> n; valid_untyped (cap.UntypedCap da w n idx) x; valid_mdb' s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; cap_table_at bits r sa; 0 < bits; length g \<le> word_bits; arg4 \<le> xa; xa \<le> arg4 + arg5 - 1\<rbrakk> \<Longrightarrow> xa < 2 ^ bits
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>s. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> rva)) s) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x s. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' sa s'a r bits g da x xa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; unat arg4 \<le> 2 ^ bits - Suc 0; unat arg5 \<le> 2 ^ bits - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r bits; bits < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; invs sa; invs' s'a; cte_wp_at (\<lambda>_. True) slot sa; pspace_aligned' s'a; cap_aligned (cap.UntypedCap da w n idx); pspace_distinct' s'a; untyped_min_bits \<le> n; valid_untyped (cap.UntypedCap da w n idx) x; valid_mdb' s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; cap_table_at bits r sa; 0 < bits; length g \<le> word_bits; arg4 \<le> xa\<rbrakk> \<Longrightarrow> arg4 + arg5 - 1 < 2 ^ bits
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>s. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> rva)) s) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x s. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' sa s'a r bits g da x xa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; unat arg4 \<le> 2 ^ bits - Suc 0; unat arg5 \<le> 2 ^ bits - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r bits; bits < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; invs sa; invs' s'a; cte_wp_at (\<lambda>_. True) slot sa; pspace_aligned' s'a; cap_aligned (cap.UntypedCap da w n idx); pspace_distinct' s'a; untyped_min_bits \<le> n; valid_untyped (cap.UntypedCap da w n idx) x; valid_mdb' s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; cap_table_at bits r sa; 0 < bits; length g \<le> word_bits; arg4 \<le> xa\<rbrakk> \<Longrightarrow> arg4 + arg5 \<le> 2 ^ bits
 2. \<And>s s' sa s'a r bits g da x xa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; unat arg4 \<le> 2 ^ bits - Suc 0; unat arg5 \<le> 2 ^ bits - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r bits; bits < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; invs sa; invs' s'a; cte_wp_at (\<lambda>_. True) slot sa; pspace_aligned' s'a; cap_aligned (cap.UntypedCap da w n idx); pspace_distinct' s'a; untyped_min_bits \<le> n; valid_untyped (cap.UntypedCap da w n idx) x; valid_mdb' s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; cap_table_at bits r sa; 0 < bits; length g \<le> word_bits; arg4 \<le> xa\<rbrakk> \<Longrightarrow> arg4 + arg5 \<noteq> 0
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>s. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> rva)) s) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x s. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 10. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>s s' sa s'a r bits g da x xa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat arg1; unat arg4 \<le> 2 ^ bits - Suc 0; unat arg5 \<le> 2 ^ bits - unat arg4; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; cap_aligned (cap.CNodeCap r bits g); is_aligned r bits; bits < 32; 0 < unat arg5; unat arg5 \<le> unat retypeFanOutLimit; unat (arg4 + arg5) = unat arg4 + unat arg5; (sa, s'a) \<in> state_relation; invs sa; invs' s'a; cte_wp_at (\<lambda>_. True) slot sa; pspace_aligned' s'a; cap_aligned (cap.UntypedCap da w n idx); pspace_distinct' s'a; untyped_min_bits \<le> n; valid_untyped (cap.UntypedCap da w n idx) x; valid_mdb' s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; cap_table_at bits r sa; 0 < bits; length g \<le> word_bits; arg4 \<le> xa\<rbrakk> \<Longrightarrow> arg4 + arg5 \<noteq> 0
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>s. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> rva)) s) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x s. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 9. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 s s' rv y rva\<rbrace> if is_cnode_cap rva then returnOk () else throwError (ExceptionTypes_A.syscall_error.FailedLookup False (ExceptionTypes_A.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x. (\<lambda>s. \<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> rva)) s) and (\<lambda>s. is_cnode_cap rva \<and> cap_aligned rva)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s s' rv y rva rv'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); cap_relation rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 s s' rv y rv'\<rbrace> if isCNodeCap rv' then returnOk () else throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat arg3))) \<lbrace>\<lambda>x s. \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' rv\<rbrace> if unat arg3 = 0 then returnOk cap else doE node_slot <- lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3);
liftE (get_cap node_slot)
odE \<lbrace>\<lambda>rva. (if is_cnode_cap rva then ?P142 s s' rv y rva else (\<lambda>_. True)) and ?Q137 s s' rv y rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and ?Q'139 s s' rv y rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and ?Q88 s s' rv) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv y node_slot. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?B1096 s s' rv y node_slot\<rbrace> get_cap node_slot \<lbrace>\<lambda>rva sa. (if is_cnode_cap rva then ?P1095 s s' rv rva else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap rva \<longrightarrow> (\<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of rva - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> rva) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> rva)) sa) \<and> is_cnode_cap rva \<and> cap_aligned rva) \<and> (\<not> is_cnode_cap rva \<longrightarrow> True)\<rbrace>
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1091 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>?B1096 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and (\<lambda>s. True \<and> (isCNodeCap rv' \<longrightarrow> \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s) \<and> (\<not> isCNodeCap rv' \<longrightarrow> True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then ?P1095 s s' rv cap else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1091 s s' rv sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv node_slot. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; 0 < unat arg3\<rbrakk> \<Longrightarrow> \<lbrace>?B1096 s s' rv () node_slot\<rbrace> get_cap node_slot \<lbrace>\<lambda>rva sa. (if is_cnode_cap rva then ?P1095 s s' rv rva else (\<lambda>_. True)) sa \<and> (is_cnode_cap rva \<longrightarrow> (\<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> 0 < unat arg5 \<and> \<not> unat retypeFanOutLimit < unat arg5 \<longrightarrow> \<not> 2 ^ bits_of rva - unat arg4 < unat arg5 \<longrightarrow> sa \<turnstile> rva \<and> invs sa \<and> cte_wp_at (\<lambda>_. True) slot sa \<and> (\<exists>d. Ex (valid_cap (cap.UntypedCap d w n idx))) \<and> sa \<turnstile> rva) \<and> cap_aligned rva)\<rbrace>
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1091 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>?B1096 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and (\<lambda>s. True \<and> (isCNodeCap rv' \<longrightarrow> \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s) \<and> (\<not> isCNodeCap rv' \<longrightarrow> True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then ?P1095 s s' rv cap else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1091 s s' rv sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv node_slot. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; 0 < unat arg3\<rbrakk> \<Longrightarrow> \<lbrace>?B1096 s s' rv () node_slot\<rbrace> get_cap node_slot \<lbrace>\<lambda>r. invs and valid_cap r and cte_wp_at (\<lambda>_. True) slot\<rbrace>
 2. \<And>s s' rv node_slot rva sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; 0 < unat arg3; (invs and valid_cap rva and cte_wp_at (\<lambda>_. True) slot) sa\<rbrakk> \<Longrightarrow> (if is_cnode_cap rva then ?P1095 s s' rv rva else (\<lambda>_. True)) sa \<and> (is_cnode_cap rva \<longrightarrow> (\<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> 0 < unat arg5 \<and> \<not> unat retypeFanOutLimit < unat arg5 \<longrightarrow> \<not> 2 ^ bits_of rva - unat arg4 < unat arg5 \<longrightarrow> sa \<turnstile> rva \<and> invs sa \<and> cte_wp_at (\<lambda>_. True) slot sa \<and> (\<exists>d. Ex (valid_cap (cap.UntypedCap d w n idx))) \<and> sa \<turnstile> rva) \<and> cap_aligned rva)
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1091 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>?B1096 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and (\<lambda>s. True \<and> (isCNodeCap rv' \<longrightarrow> \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s) \<and> (\<not> isCNodeCap rv' \<longrightarrow> True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then ?P1095 s s' rv cap else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1091 s s' rv sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 8. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv node_slot rva sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; unat arg1 < word_bits \<and> obj_bits_api rv (unat arg1) \<le> 29; rv = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; rv = Structures_A.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; 0 < unat arg3; (invs and valid_cap rva and cte_wp_at (\<lambda>_. True) slot) sa\<rbrakk> \<Longrightarrow> (if is_cnode_cap rva then ?P1095 s s' rv rva else (\<lambda>_. True)) sa \<and> (is_cnode_cap rva \<longrightarrow> (\<not> 2 ^ bits_of rva - Suc 0 < unat arg4 \<longrightarrow> 0 < unat arg5 \<and> \<not> unat retypeFanOutLimit < unat arg5 \<longrightarrow> \<not> 2 ^ bits_of rva - unat arg4 < unat arg5 \<longrightarrow> sa \<turnstile> rva \<and> invs sa \<and> cte_wp_at (\<lambda>_. True) slot sa \<and> (\<exists>d. Ex (valid_cap (cap.UntypedCap d w n idx))) \<and> sa \<turnstile> rva) \<and> cap_aligned rva)
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1091 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>\<lambda>a b. invs b \<and> valid_objs b \<and> cte_wp_at (\<lambda>_. True) slot b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and (\<lambda>s. True \<and> (isCNodeCap rv' \<longrightarrow> \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s) \<and> (\<not> isCNodeCap rv' \<longrightarrow> True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then ?P1095 s s' rv cap else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1091 s s' rv sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' sa r bits g. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < 32; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; 0 < unat arg3; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; is_aligned (obj_ref_of cap) (cap_bits cap); unat arg1 < 32; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; invs sa; cap_bits cap < 32; is_aligned r (cte_level_bits + bits); case cap of cap.UntypedCap dev p b f \<Rightarrow> valid_untyped cap s \<and> untyped_min_bits \<le> b \<and> f \<le> 2 ^ b \<and> p \<noteq> 0 | cap.EndpointCap r badge rights \<Rightarrow> ep_at r s | cap.NotificationCap r badge rights \<Rightarrow> ntfn_at r s \<and> AllowGrant \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.ReplyCap r m rights \<Rightarrow> tcb_at r s \<and> AllowWrite \<in> rights \<and> AllowRead \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.CNodeCap r bits guard \<Rightarrow> cap_table_at bits r s \<and> bits \<noteq> 0 \<and> length guard \<le> word_bits | cap.ThreadCap r \<Rightarrow> tcb_at r s | cap.IRQHandlerCap irq \<Rightarrow> irq \<le> maxIRQ | cap.Zombie r None n \<Rightarrow> tcb_at r s \<and> n \<le> 5 | cap.Zombie r (Some ba) n \<Rightarrow> cap_table_at ba r s \<and> n \<le> 2 ^ ba \<and> ba \<noteq> 0 | cap.ArchObjectCap (arch_cap.ASIDPoolCap r as) \<Rightarrow> typ_at (AArch AASIDPool) r s \<and> is_aligned as local.asid_low_bits \<and> as \<le> 2 ^ local.asid_bits - 1 | cap.ArchObjectCap arch_cap.ASIDControlCap \<Rightarrow> True | cap.ArchObjectCap (arch_cap.PageCap dev r rghts sz mapdata) \<Rightarrow> (if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s) \<and> rghts \<in> valid_vm_rights \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned ref sz \<and> ref < kernel_base) | cap.ArchObjectCap (arch_cap.PageTableCap r mapdata) \<Rightarrow> typ_at (AArch APageTable) r s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, vref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vref < kernel_base \<and> is_aligned vref (pageBitsForSize ARMSection)) | cap.ArchObjectCap (arch_cap.PageDirectoryCap r mapdata) \<Rightarrow> typ_at (AArch APageDirectory) r s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | _ \<Rightarrow> True; \<forall>x\<in>set csmore. is_aligned (obj_ref_of x) (cap_bits x) \<and> cap_bits x < 32 \<and> (case x of cap.UntypedCap dev p b f \<Rightarrow> valid_untyped x s \<and> untyped_min_bits \<le> b \<and> f \<le> 2 ^ b \<and> p \<noteq> 0 | cap.EndpointCap r badge rights \<Rightarrow> ep_at r s | cap.NotificationCap r badge rights \<Rightarrow> ntfn_at r s \<and> AllowGrant \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.ReplyCap r m rights \<Rightarrow> tcb_at r s \<and> AllowWrite \<in> rights \<and> AllowRead \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.CNodeCap r bits guard \<Rightarrow> cap_table_at bits r s \<and> bits \<noteq> 0 \<and> length guard \<le> word_bits | cap.ThreadCap r \<Rightarrow> tcb_at r s | cap.IRQHandlerCap irq \<Rightarrow> irq \<le> maxIRQ | cap.Zombie r None n \<Rightarrow> tcb_at r s \<and> n \<le> 5 | cap.Zombie r (Some ba) n \<Rightarrow> cap_table_at ba r s \<and> n \<le> 2 ^ ba \<and> ba \<noteq> 0 | cap.ArchObjectCap (arch_cap.ASIDPoolCap r as) \<Rightarrow> typ_at (AArch AASIDPool) r s \<and> is_aligned as local.asid_low_bits \<and> as \<le> 2 ^ local.asid_bits - 1 | cap.ArchObjectCap arch_cap.ASIDControlCap \<Rightarrow> True | cap.ArchObjectCap (arch_cap.PageCap dev r rghts sz mapdata) \<Rightarrow> (if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s) \<and> rghts \<in> valid_vm_rights \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned ref sz \<and> ref < kernel_base) | cap.ArchObjectCap (arch_cap.PageTableCap r mapdata) \<Rightarrow> typ_at (AArch APageTable) r s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, vref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vref < kernel_base \<and> is_aligned vref (pageBitsForSize ARMSection)) | cap.ArchObjectCap (arch_cap.PageDirectoryCap r mapdata) \<Rightarrow> typ_at (AArch APageDirectory) r s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | _ \<Rightarrow> True); cte_level_bits + bits < 32; cte_wp_at (\<lambda>_. True) slot sa; cap_table_at bits r sa; 0 < bits; length g \<le> 32\<rbrakk> \<Longrightarrow> ?P1095 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa \<and> (\<not> 2 ^ bits - Suc 0 < unat arg4 \<longrightarrow> 0 < unat arg5 \<and> \<not> unat retypeFanOutLimit < unat arg5 \<longrightarrow> \<not> 2 ^ bits - unat arg4 < unat arg5 \<longrightarrow> (\<exists>d. Ex (valid_cap (cap.UntypedCap d w n idx))))
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1091 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>\<lambda>a b. invs b \<and> valid_objs b \<and> cte_wp_at (\<lambda>_. True) slot b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and (\<lambda>s. True \<and> (isCNodeCap rv' \<longrightarrow> \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s) \<and> (\<not> isCNodeCap rv' \<longrightarrow> True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then ?P1095 s s' rv cap else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1091 s s' rv sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' sa r bits g. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < 32; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; 0 < unat arg3; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; is_aligned (obj_ref_of cap) (cap_bits cap); unat arg1 < 32; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; invs sa; cap_bits cap < 32; is_aligned r (cte_level_bits + bits); case cap of cap.UntypedCap dev p b f \<Rightarrow> valid_untyped cap s \<and> untyped_min_bits \<le> b \<and> f \<le> 2 ^ b \<and> p \<noteq> 0 | cap.EndpointCap r badge rights \<Rightarrow> ep_at r s | cap.NotificationCap r badge rights \<Rightarrow> ntfn_at r s \<and> AllowGrant \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.ReplyCap r m rights \<Rightarrow> tcb_at r s \<and> AllowWrite \<in> rights \<and> AllowRead \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.CNodeCap r bits guard \<Rightarrow> cap_table_at bits r s \<and> bits \<noteq> 0 \<and> length guard \<le> word_bits | cap.ThreadCap r \<Rightarrow> tcb_at r s | cap.IRQHandlerCap irq \<Rightarrow> irq \<le> maxIRQ | cap.Zombie r None n \<Rightarrow> tcb_at r s \<and> n \<le> 5 | cap.Zombie r (Some ba) n \<Rightarrow> cap_table_at ba r s \<and> n \<le> 2 ^ ba \<and> ba \<noteq> 0 | cap.ArchObjectCap (arch_cap.ASIDPoolCap r as) \<Rightarrow> typ_at (AArch AASIDPool) r s \<and> is_aligned as local.asid_low_bits \<and> as \<le> 2 ^ local.asid_bits - 1 | cap.ArchObjectCap arch_cap.ASIDControlCap \<Rightarrow> True | cap.ArchObjectCap (arch_cap.PageCap dev r rghts sz mapdata) \<Rightarrow> (if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s) \<and> rghts \<in> valid_vm_rights \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned ref sz \<and> ref < kernel_base) | cap.ArchObjectCap (arch_cap.PageTableCap r mapdata) \<Rightarrow> typ_at (AArch APageTable) r s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, vref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vref < kernel_base \<and> is_aligned vref (pageBitsForSize ARMSection)) | cap.ArchObjectCap (arch_cap.PageDirectoryCap r mapdata) \<Rightarrow> typ_at (AArch APageDirectory) r s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | _ \<Rightarrow> True; \<forall>x\<in>set csmore. is_aligned (obj_ref_of x) (cap_bits x) \<and> cap_bits x < 32 \<and> (case x of cap.UntypedCap dev p b f \<Rightarrow> valid_untyped x s \<and> untyped_min_bits \<le> b \<and> f \<le> 2 ^ b \<and> p \<noteq> 0 | cap.EndpointCap r badge rights \<Rightarrow> ep_at r s | cap.NotificationCap r badge rights \<Rightarrow> ntfn_at r s \<and> AllowGrant \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.ReplyCap r m rights \<Rightarrow> tcb_at r s \<and> AllowWrite \<in> rights \<and> AllowRead \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.CNodeCap r bits guard \<Rightarrow> cap_table_at bits r s \<and> bits \<noteq> 0 \<and> length guard \<le> word_bits | cap.ThreadCap r \<Rightarrow> tcb_at r s | cap.IRQHandlerCap irq \<Rightarrow> irq \<le> maxIRQ | cap.Zombie r None n \<Rightarrow> tcb_at r s \<and> n \<le> 5 | cap.Zombie r (Some ba) n \<Rightarrow> cap_table_at ba r s \<and> n \<le> 2 ^ ba \<and> ba \<noteq> 0 | cap.ArchObjectCap (arch_cap.ASIDPoolCap r as) \<Rightarrow> typ_at (AArch AASIDPool) r s \<and> is_aligned as local.asid_low_bits \<and> as \<le> 2 ^ local.asid_bits - 1 | cap.ArchObjectCap arch_cap.ASIDControlCap \<Rightarrow> True | cap.ArchObjectCap (arch_cap.PageCap dev r rghts sz mapdata) \<Rightarrow> (if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s) \<and> rghts \<in> valid_vm_rights \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned ref sz \<and> ref < kernel_base) | cap.ArchObjectCap (arch_cap.PageTableCap r mapdata) \<Rightarrow> typ_at (AArch APageTable) r s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, vref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vref < kernel_base \<and> is_aligned vref (pageBitsForSize ARMSection)) | cap.ArchObjectCap (arch_cap.PageDirectoryCap r mapdata) \<Rightarrow> typ_at (AArch APageDirectory) r s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | _ \<Rightarrow> True); cte_level_bits + bits < 32; cte_wp_at (\<lambda>_. True) slot sa; cap_table_at bits r sa; 0 < bits; length g \<le> 32; s \<turnstile> cap.UntypedCap d w n idx\<rbrakk> \<Longrightarrow> ?P1095 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa \<and> (\<not> 2 ^ bits - Suc 0 < unat arg4 \<longrightarrow> 0 < unat arg5 \<and> \<not> unat retypeFanOutLimit < unat arg5 \<longrightarrow> \<not> 2 ^ bits - unat arg4 < unat arg5 \<longrightarrow> (\<exists>d. Ex (valid_cap (cap.UntypedCap d w n idx))))
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1091 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>\<lambda>a b. invs b \<and> valid_objs b \<and> cte_wp_at (\<lambda>_. True) slot b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and (\<lambda>s. True \<and> (isCNodeCap rv' \<longrightarrow> \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s) \<and> (\<not> isCNodeCap rv' \<longrightarrow> True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then ?P1095 s s' rv cap else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1091 s s' rv sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' sa r bits g. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < 32; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; 0 < unat arg3; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; is_aligned (obj_ref_of cap) (cap_bits cap); unat arg1 < 32; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; invs sa; cap_bits cap < 32; is_aligned r (cte_level_bits + bits); case cap of cap.UntypedCap dev p b f \<Rightarrow> valid_untyped cap s \<and> untyped_min_bits \<le> b \<and> f \<le> 2 ^ b \<and> p \<noteq> 0 | cap.EndpointCap r badge rights \<Rightarrow> ep_at r s | cap.NotificationCap r badge rights \<Rightarrow> ntfn_at r s \<and> AllowGrant \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.ReplyCap r m rights \<Rightarrow> tcb_at r s \<and> AllowWrite \<in> rights \<and> AllowRead \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.CNodeCap r bits guard \<Rightarrow> cap_table_at bits r s \<and> bits \<noteq> 0 \<and> length guard \<le> word_bits | cap.ThreadCap r \<Rightarrow> tcb_at r s | cap.IRQHandlerCap irq \<Rightarrow> irq \<le> maxIRQ | cap.Zombie r None n \<Rightarrow> tcb_at r s \<and> n \<le> 5 | cap.Zombie r (Some ba) n \<Rightarrow> cap_table_at ba r s \<and> n \<le> 2 ^ ba \<and> ba \<noteq> 0 | cap.ArchObjectCap (arch_cap.ASIDPoolCap r as) \<Rightarrow> typ_at (AArch AASIDPool) r s \<and> is_aligned as local.asid_low_bits \<and> as \<le> 2 ^ local.asid_bits - 1 | cap.ArchObjectCap arch_cap.ASIDControlCap \<Rightarrow> True | cap.ArchObjectCap (arch_cap.PageCap dev r rghts sz mapdata) \<Rightarrow> (if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s) \<and> rghts \<in> valid_vm_rights \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned ref sz \<and> ref < kernel_base) | cap.ArchObjectCap (arch_cap.PageTableCap r mapdata) \<Rightarrow> typ_at (AArch APageTable) r s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, vref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vref < kernel_base \<and> is_aligned vref (pageBitsForSize ARMSection)) | cap.ArchObjectCap (arch_cap.PageDirectoryCap r mapdata) \<Rightarrow> typ_at (AArch APageDirectory) r s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | _ \<Rightarrow> True; \<forall>x\<in>set csmore. is_aligned (obj_ref_of x) (cap_bits x) \<and> cap_bits x < 32 \<and> (case x of cap.UntypedCap dev p b f \<Rightarrow> valid_untyped x s \<and> untyped_min_bits \<le> b \<and> f \<le> 2 ^ b \<and> p \<noteq> 0 | cap.EndpointCap r badge rights \<Rightarrow> ep_at r s | cap.NotificationCap r badge rights \<Rightarrow> ntfn_at r s \<and> AllowGrant \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.ReplyCap r m rights \<Rightarrow> tcb_at r s \<and> AllowWrite \<in> rights \<and> AllowRead \<notin> rights \<and> AllowGrantReply \<notin> rights | cap.CNodeCap r bits guard \<Rightarrow> cap_table_at bits r s \<and> bits \<noteq> 0 \<and> length guard \<le> word_bits | cap.ThreadCap r \<Rightarrow> tcb_at r s | cap.IRQHandlerCap irq \<Rightarrow> irq \<le> maxIRQ | cap.Zombie r None n \<Rightarrow> tcb_at r s \<and> n \<le> 5 | cap.Zombie r (Some ba) n \<Rightarrow> cap_table_at ba r s \<and> n \<le> 2 ^ ba \<and> ba \<noteq> 0 | cap.ArchObjectCap (arch_cap.ASIDPoolCap r as) \<Rightarrow> typ_at (AArch AASIDPool) r s \<and> is_aligned as local.asid_low_bits \<and> as \<le> 2 ^ local.asid_bits - 1 | cap.ArchObjectCap arch_cap.ASIDControlCap \<Rightarrow> True | cap.ArchObjectCap (arch_cap.PageCap dev r rghts sz mapdata) \<Rightarrow> (if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s) \<and> rghts \<in> valid_vm_rights \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned ref sz \<and> ref < kernel_base) | cap.ArchObjectCap (arch_cap.PageTableCap r mapdata) \<Rightarrow> typ_at (AArch APageTable) r s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, vref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vref < kernel_base \<and> is_aligned vref (pageBitsForSize ARMSection)) | cap.ArchObjectCap (arch_cap.PageDirectoryCap r mapdata) \<Rightarrow> typ_at (AArch APageDirectory) r s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | _ \<Rightarrow> True); cte_level_bits + bits < 32; cte_wp_at (\<lambda>_. True) slot sa; cap_table_at bits r sa; 0 < bits; length g \<le> 32; s \<turnstile> cap.UntypedCap d w n idx\<rbrakk> \<Longrightarrow> True \<and> (\<not> 2 ^ bits - Suc 0 < unat arg4 \<longrightarrow> 0 < unat arg5 \<and> \<not> unat retypeFanOutLimit < unat arg5 \<longrightarrow> \<not> 2 ^ bits - unat arg4 < unat arg5 \<longrightarrow> True)
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1091 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>\<lambda>a b. invs b \<and> valid_objs b \<and> cte_wp_at (\<lambda>_. True) slot b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and (\<lambda>s. True \<and> (isCNodeCap rv' \<longrightarrow> \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s) \<and> (\<not> isCNodeCap rv' \<longrightarrow> True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then \<lambda>a. ?t1159 s s' rv cap a = ?t1158 s s' rv cap a else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1091 s s' rv sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa
flex-flex pairs:
\<lambda>s s' sa r bits g. ?t1159 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa \<equiv>\<^sup>? \<lambda>s s' sa r bits g. ?t1158 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa proof (prove)
goal (6 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1091 s s' rv\<rbrace> lookup_slot_for_cnode_op False cap (to_bl arg2) (unat arg3) \<lbrace>\<lambda>a b. invs b \<and> valid_objs b \<and> cte_wp_at (\<lambda>_. True) slot b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'90 s s' y\<rbrace> if unat arg3 = 0 then returnOk cap' else doE nodeSlot <- lookupSlotForCNodeOp False cap' arg2 (unat arg3);
liftE (getSlotCap nodeSlot)
odE \<lbrace>\<lambda>rv'. (if isCNodeCap rv' then ?P'145 s s' rv y rv' else (\<lambda>_. True)) and (\<lambda>s. True \<and> (isCNodeCap rv' \<longrightarrow> \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) s) \<and> (\<not> isCNodeCap rv' \<longrightarrow> True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then \<lambda>a. ?t1159 s s' rv cap a = ?t1158 s s' rv cap a else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1091 s s' rv sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and ?Q'90 s s' y) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa
flex-flex pairs:
\<lambda>s s' sa r bits g. ?t1159 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa \<equiv>\<^sup>? \<lambda>s s' sa r bits g. ?t1158 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa proof (prove)
goal (6 subgoals):
 1. \<And>s s' rv y x. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?B1223 s s' rv y x\<rbrace> getSlotCap x \<lbrace>\<lambda>rv' sa. (if isCNodeCap rv' then ?P'1222 s s' y rv' else (\<lambda>_. True)) sa \<and> True \<and> (isCNodeCap rv' \<longrightarrow> \<not> 2 ^ capCNodeBits rv' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rv' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) sa) \<and> (\<not> isCNodeCap rv' \<longrightarrow> True)\<rbrace>
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 s s' y\<rbrace> lookupSlotForCNodeOp False cap' arg2 (unat arg3) \<lbrace>?B1223 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then \<lambda>a. ?t1159 s s' rv cap a = ?t1158 s s' rv cap a else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> True \<and> invs sa \<and> valid_objs sa \<and> cte_wp_at (\<lambda>_. True) slot sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and (\<lambda>a. True \<and> (unat arg3 = 0 \<longrightarrow> (if isCNodeCap cap' then ?P'1222 s s' y cap' else (\<lambda>_. True)) a \<and> True \<and> (isCNodeCap cap' \<longrightarrow> \<not> 2 ^ capCNodeBits cap' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits cap' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) a) \<and> (\<not> isCNodeCap cap' \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1217 s s' y a))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa
flex-flex pairs:
\<lambda>s s' sa r bits g. ?t1159 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa \<equiv>\<^sup>? \<lambda>s s' sa r bits g. ?t1158 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv y x. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?B1223 s s' rv y x\<rbrace> getSlotCap x \<lbrace>\<lambda>r. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)\<rbrace>
 2. \<And>s s' rv y x rva sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0; (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) sa\<rbrakk> \<Longrightarrow> (if isCNodeCap rva then ?P'1222 s s' y rva else (\<lambda>_. True)) sa \<and> True \<and> (isCNodeCap rva \<longrightarrow> \<not> 2 ^ capCNodeBits rva - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rva - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) sa) \<and> (\<not> isCNodeCap rva \<longrightarrow> True)
 3. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 s s' y\<rbrace> lookupSlotForCNodeOp False cap' arg2 (unat arg3) \<lbrace>?B1223 s s' rv y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then \<lambda>a. ?t1159 s s' rv cap a = ?t1158 s s' rv cap a else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> True \<and> invs sa \<and> valid_objs sa \<and> cte_wp_at (\<lambda>_. True) slot sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and (\<lambda>a. True \<and> (unat arg3 = 0 \<longrightarrow> (if isCNodeCap cap' then ?P'1222 s s' y cap' else (\<lambda>_. True)) a \<and> True \<and> (isCNodeCap cap' \<longrightarrow> \<not> 2 ^ capCNodeBits cap' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits cap' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) a) \<and> (\<not> isCNodeCap cap' \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1217 s s' y a))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 7. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa
flex-flex pairs:
\<lambda>s s' sa r bits g. ?t1159 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa \<equiv>\<^sup>? \<lambda>s s' sa r bits g. ?t1158 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa proof (prove)
goal (6 subgoals):
 1. \<And>s s' rv y x rva sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0; (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) sa\<rbrakk> \<Longrightarrow> (if isCNodeCap rva then ?P'1222 s s' y rva else (\<lambda>_. True)) sa \<and> True \<and> (isCNodeCap rva \<longrightarrow> \<not> 2 ^ capCNodeBits rva - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits rva - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) sa) \<and> (\<not> isCNodeCap rva \<longrightarrow> True)
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 s s' y\<rbrace> lookupSlotForCNodeOp False cap' arg2 (unat arg3) \<lbrace>\<lambda>x. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then \<lambda>a. ?t1159 s s' rv cap a = ?t1158 s s' rv cap a else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> True \<and> invs sa \<and> valid_objs sa \<and> cte_wp_at (\<lambda>_. True) slot sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and (\<lambda>a. True \<and> (unat arg3 = 0 \<longrightarrow> (if isCNodeCap cap' then ?P'1222 s s' y cap' else (\<lambda>_. True)) a \<and> True \<and> (isCNodeCap cap' \<longrightarrow> \<not> 2 ^ capCNodeBits cap' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits cap' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) a) \<and> (\<not> isCNodeCap cap' \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1217 s s' y a))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa
flex-flex pairs:
\<lambda>s s' sa r bits g. ?t1159 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa \<equiv>\<^sup>? \<lambda>s s' sa r bits g. ?t1158 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa proof (prove)
goal (6 subgoals):
 1. \<And>s s' rva sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; caps_of_state s slot = Some (cap.UntypedCap d w n idx); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat arg1; toEnum (unat arg0) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat arg1 < 4; 0 < unat arg3; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; s \<turnstile> cap; \<forall>x\<in>set csmore. s \<turnstile> x; unat arg1 < word_bits; obj_bits_api (APIType_map2 (Inr (toEnum (unat arg0)))) (unat arg1) \<le> 29; invs' sa; cte_wp_at' (\<lambda>_. True) (cte_map slot) sa; isCNodeCap rva\<rbrakk> \<Longrightarrow> ?P'1222 s s' () rva sa \<and> (\<not> 2 ^ capCNodeBits rva - 1 < arg4 \<longrightarrow> arg5 \<noteq> 0 \<and> \<not> retypeFanOutLimit < arg5 \<longrightarrow> \<not> 2 ^ capCNodeBits rva - arg4 < arg5 \<longrightarrow> valid_mdb' sa)
 2. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 s s' y\<rbrace> lookupSlotForCNodeOp False cap' arg2 (unat arg3) \<lbrace>\<lambda>x. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then \<lambda>a. ?t1159 s s' rv cap a = ?t1158 s s' rv cap a else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> True \<and> invs sa \<and> valid_objs sa \<and> cte_wp_at (\<lambda>_. True) slot sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and (\<lambda>a. True \<and> (unat arg3 = 0 \<longrightarrow> (if isCNodeCap cap' then ?P'1222 s s' y cap' else (\<lambda>_. True)) a \<and> True \<and> (isCNodeCap cap' \<longrightarrow> \<not> 2 ^ capCNodeBits cap' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits cap' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) a) \<and> (\<not> isCNodeCap cap' \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1217 s s' y a))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 6. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa
flex-flex pairs:
\<lambda>s s' sa r bits g. ?t1159 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa \<equiv>\<^sup>? \<lambda>s s' sa r bits g. ?t1158 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa proof (prove)
goal (5 subgoals):
 1. \<And>s s' rv y. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; APIType_map2 (Inr (toEnum (unat arg0))) = rv; \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29); \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0); \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4); unat arg3 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 s s' y\<rbrace> lookupSlotForCNodeOp False cap' arg2 (unat arg3) \<lbrace>\<lambda>x. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 s s'\<rbrace> data_to_obj_type arg0 \<lbrace>\<lambda>rv sa. \<not> (unat arg1 < word_bits \<longrightarrow> \<not> obj_bits_api rv (unat arg1) \<le> 29) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (rv = Structures_A.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and valid_cap cap and (\<lambda>s. True \<and> (invs and valid_cap cap) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then \<lambda>a. ?t1159 s s' rv cap a = ?t1158 s s' rv cap a else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> True \<and> invs sa \<and> valid_objs sa \<and> cte_wp_at (\<lambda>_. True) slot sa))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'37 s s'\<rbrace> whenE (fromEnum maxBound < unat arg0) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>y sa. \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and (\<lambda>a. True \<and> (unat arg3 = 0 \<longrightarrow> (if isCNodeCap cap' then \<lambda>a. (s, s') \<in> state_relation else (\<lambda>_. True)) a \<and> True \<and> (isCNodeCap cap' \<longrightarrow> \<not> 2 ^ capCNodeBits cap' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits cap' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) a) \<and> (\<not> isCNodeCap cap' \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> ?R1217 s s' y a))) sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q37 s s') sa
 5. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'37 s s') sa
flex-flex pairs:
\<lambda>s s' sa r bits g. ?t1159 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa \<equiv>\<^sup>? \<lambda>s s' sa r bits g. ?t1158 s s' (APIType_map2 (Inr (toEnum (unat arg0)))) (cap.CNodeCap r bits g) sa proof (prove)
goal (2 subgoals):
 1. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>sa. True \<and> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs and pspace_aligned and (\<lambda>a. a \<turnstile> cap) and (\<lambda>s. True \<and> (invs and (\<lambda>a. a \<turnstile> cap)) s)) and (\<lambda>sa. True \<and> (unat arg3 = 0 \<longrightarrow> (if is_cnode_cap cap then \<lambda>a. ?t1313 s s' cap a = ?t1311 s s' cap a else (\<lambda>_. True)) sa \<and> True \<and> (is_cnode_cap cap \<longrightarrow> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> \<not> (unat arg5 = 0 \<or> unat retypeFanOutLimit < unat arg5) \<longrightarrow> \<not> (unat arg5 = 0 \<or> 2 ^ bits_of cap - unat arg4 < unat arg5) \<longrightarrow> ((\<lambda>a. a \<turnstile> cap) and invs and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>a. (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx) \<and> (\<exists>d a. a \<turnstile> cap.UntypedCap d w n idx))) and (\<lambda>a. a \<turnstile> cap)) sa) \<and> is_cnode_cap cap \<and> cap_aligned cap) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> True \<and> invs sa \<and> valid_objs sa \<and> cte_wp_at (\<lambda>_. True) slot sa))) sa)) sa
 2. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>sa. \<not> fromEnum maxBound < unat arg0 \<longrightarrow> \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and (\<lambda>a. True \<and> (unat arg3 = 0 \<longrightarrow> (if isCNodeCap cap' then \<lambda>a. (s, s') \<in> state_relation else (\<lambda>_. True)) a \<and> True \<and> (isCNodeCap cap' \<longrightarrow> \<not> 2 ^ capCNodeBits cap' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits cap' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) a) \<and> (\<not> isCNodeCap cap' \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> True \<and> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) a))) sa)) sa
flex-flex pairs:
\<lambda>s s' sa r bits g. ?t1313 s s' (cap.CNodeCap r bits g) sa \<equiv>\<^sup>? \<lambda>s s' sa r bits g. ?t1311 s s' (cap.CNodeCap r bits g) sa proof (prove)
goal (2 subgoals):
 1. \<And>s' sa cte. \<lbrakk>(sa, s') \<in> state_relation; invs sa; invs' s'; caps_of_state sa slot = Some (cap.UntypedCap d w n idx); is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) sa; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; sa \<turnstile> cap; \<forall>x\<in>set csmore. sa \<turnstile> x; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap d w n idx\<rbrakk> \<Longrightarrow> (is_cnode_cap cap \<longrightarrow> (unat arg3 = 0 \<longrightarrow> ?t1313 sa s' cap sa = ?t1311 sa s' cap sa \<and> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> 0 < unat arg5 \<and> \<not> unat retypeFanOutLimit < unat arg5 \<longrightarrow> \<not> 2 ^ bits_of cap - unat arg4 < unat arg5 \<longrightarrow> (\<exists>d. Ex (valid_cap (cap.UntypedCap d w n idx)))) \<and> cap_aligned cap) \<and> (0 < unat arg3 \<longrightarrow> valid_objs sa \<and> pspace_aligned sa \<and> valid_objs sa)) \<and> (\<not> is_cnode_cap cap \<longrightarrow> 0 < unat arg3 \<longrightarrow> valid_objs sa \<and> pspace_aligned sa \<and> valid_objs sa)
 2. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>sa. \<not> fromEnum maxBound < unat arg0 \<longrightarrow> \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and (\<lambda>a. True \<and> (unat arg3 = 0 \<longrightarrow> (if isCNodeCap cap' then \<lambda>a. (s, s') \<in> state_relation else (\<lambda>_. True)) a \<and> True \<and> (isCNodeCap cap' \<longrightarrow> \<not> 2 ^ capCNodeBits cap' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits cap' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) a) \<and> (\<not> isCNodeCap cap' \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> True \<and> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) a))) sa)) sa
flex-flex pairs:
\<lambda>s s' sa r bits g. ?t1313 s s' (cap.CNodeCap r bits g) sa \<equiv>\<^sup>? \<lambda>s s' sa r bits g. ?t1311 s s' (cap.CNodeCap r bits g) sa proof (prove)
goal (2 subgoals):
 1. \<And>s' sa cte. \<lbrakk>(sa, s') \<in> state_relation; invs sa; invs' s'; caps_of_state sa slot = Some (cap.UntypedCap d w n idx); is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) sa; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; sa \<turnstile> cap; \<forall>x\<in>set csmore. sa \<turnstile> x; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap d w n idx; is_cnode_cap cap; unat arg3 = 0\<rbrakk> \<Longrightarrow> ?t1313 sa s' cap sa = ?t1311 sa s' cap sa \<and> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> 0 < unat arg5 \<and> \<not> unat retypeFanOutLimit < unat arg5 \<longrightarrow> \<not> 2 ^ bits_of cap - unat arg4 < unat arg5 \<longrightarrow> (\<exists>d. Ex (valid_cap (cap.UntypedCap d w n idx)))) \<and> cap_aligned cap
 2. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>sa. \<not> fromEnum maxBound < unat arg0 \<longrightarrow> \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and (\<lambda>a. True \<and> (unat arg3 = 0 \<longrightarrow> (if isCNodeCap cap' then \<lambda>a. (s, s') \<in> state_relation else (\<lambda>_. True)) a \<and> True \<and> (isCNodeCap cap' \<longrightarrow> \<not> 2 ^ capCNodeBits cap' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits cap' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) a) \<and> (\<not> isCNodeCap cap' \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> True \<and> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) a))) sa)) sa
flex-flex pairs:
\<lambda>s s' sa r bits g. ?t1313 s s' (cap.CNodeCap r bits g) sa \<equiv>\<^sup>? \<lambda>s s' sa r bits g. ?t1311 s s' (cap.CNodeCap r bits g) sa proof (prove)
goal (2 subgoals):
 1. \<And>s' sa cte. \<lbrakk>(sa, s') \<in> state_relation; invs sa; invs' s'; caps_of_state sa slot = Some (cap.UntypedCap d w n idx); is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) sa; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; sa \<turnstile> cap; \<forall>x\<in>set csmore. sa \<turnstile> x; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap d w n idx; is_cnode_cap cap; unat arg3 = 0; sa \<turnstile> cap.UntypedCap d w n idx\<rbrakk> \<Longrightarrow> ?t1313 sa s' cap sa = ?t1311 sa s' cap sa \<and> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> 0 < unat arg5 \<and> \<not> unat retypeFanOutLimit < unat arg5 \<longrightarrow> \<not> 2 ^ bits_of cap - unat arg4 < unat arg5 \<longrightarrow> (\<exists>d. Ex (valid_cap (cap.UntypedCap d w n idx)))) \<and> cap_aligned cap
 2. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>sa. \<not> fromEnum maxBound < unat arg0 \<longrightarrow> \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and (\<lambda>a. True \<and> (unat arg3 = 0 \<longrightarrow> (if isCNodeCap cap' then \<lambda>a. (s, s') \<in> state_relation else (\<lambda>_. True)) a \<and> True \<and> (isCNodeCap cap' \<longrightarrow> \<not> 2 ^ capCNodeBits cap' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits cap' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) a) \<and> (\<not> isCNodeCap cap' \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> True \<and> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) a))) sa)) sa
flex-flex pairs:
\<lambda>s s' sa r bits g. ?t1313 s s' (cap.CNodeCap r bits g) sa \<equiv>\<^sup>? \<lambda>s s' sa r bits g. ?t1311 s s' (cap.CNodeCap r bits g) sa proof (prove)
goal (2 subgoals):
 1. \<And>s' sa cte. \<lbrakk>(sa, s') \<in> state_relation; invs sa; invs' s'; caps_of_state sa slot = Some (cap.UntypedCap d w n idx); is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) sa; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; valid_cap' cap' s'; \<forall>x\<in>set csmore'. valid_cap' x s'; sa \<turnstile> cap; \<forall>x\<in>set csmore. sa \<turnstile> x; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap d w n idx; is_cnode_cap cap; unat arg3 = 0; sa \<turnstile> cap.UntypedCap d w n idx\<rbrakk> \<Longrightarrow> True \<and> (\<not> 2 ^ bits_of cap - Suc 0 < unat arg4 \<longrightarrow> 0 < unat arg5 \<and> \<not> unat retypeFanOutLimit < unat arg5 \<longrightarrow> \<not> 2 ^ bits_of cap - unat arg4 < unat arg5 \<longrightarrow> True) \<and> cap_aligned cap
 2. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>sa. \<not> fromEnum maxBound < unat arg0 \<longrightarrow> \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and (\<lambda>a. True \<and> (unat arg3 = 0 \<longrightarrow> (if isCNodeCap cap' then \<lambda>a. (s, s') \<in> state_relation else (\<lambda>_. True)) a \<and> True \<and> (isCNodeCap cap' \<longrightarrow> \<not> 2 ^ capCNodeBits cap' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits cap' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) a) \<and> (\<not> isCNodeCap cap' \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> True \<and> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) a))) sa)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s s' sa. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_cap' cap' s' \<and> (\<forall>x\<in>set csmore'. valid_cap' x s'); caps_of_state s slot = Some (cap.UntypedCap d w n idx); s \<turnstile> cap \<and> (\<forall>x\<in>set csmore. s \<turnstile> x); cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w n idx) (cte_map slot) s'; is_aligned w n; n < word_bits; valid_untyped (cap.UntypedCap d w n idx) s; 4 \<le> n; idx \<le> 2 ^ n; w \<noteq> 0; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>sa. \<not> fromEnum maxBound < unat arg0 \<longrightarrow> \<not> (\<not> unat arg1 < wordBits \<or> 29 < APIType_capBits (toEnum (unat arg0)) (unat arg1)) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat arg1 = 0) \<longrightarrow> \<not> (toEnum (unat arg0) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat arg1 < 4) \<longrightarrow> ((if unat arg3 = 0 then \<lambda>_. True else valid_objs' and pspace_aligned' and pspace_distinct' and valid_cap' cap' and (\<lambda>a. True \<and> (pspace_distinct' and pspace_aligned') a)) and (\<lambda>a. True \<and> (unat arg3 = 0 \<longrightarrow> (if isCNodeCap cap' then \<lambda>a. (s, s') \<in> state_relation else (\<lambda>_. True)) a \<and> True \<and> (isCNodeCap cap' \<longrightarrow> \<not> 2 ^ capCNodeBits cap' - 1 < arg4 \<longrightarrow> \<not> (arg5 = 0 \<or> retypeFanOutLimit < arg5) \<longrightarrow> \<not> (arg5 = 0 \<or> 2 ^ capCNodeBits cap' - arg4 < arg5) \<longrightarrow> (invs' and (pspace_aligned' and pspace_distinct' and valid_mdb' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>a. True))) a) \<and> (\<not> isCNodeCap cap' \<longrightarrow> True)) \<and> (unat arg3 \<noteq> 0 \<longrightarrow> True \<and> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) a))) sa)) sa proof (prove)
goal:
No subgoals! proof (state)
this:
corres (ser \<oplus> untypinv_relation) (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) (invs' and (\<lambda>s. \<forall>x\<in>set cs'. valid_cap' x s)) (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs) (decodeUntypedInvocation label args (cte_map slot) (capability.UntypedCap d w n idx) cs')

goal:
No subgoals!