theory CSpace_RAB_C

lemma resolveAddressBits_ccorres [corres]:
  shows "ccorres (lookup_failure_rel \<currency>
    (\<lambda>(cte, bits) (cte', bits'). cte' = Ptr cte \<and> bits = unat bits' \<and> bits'\<le> 32)) rab_xf
  (valid_pspace' and valid_cap' cap'
        and K (guard' \<le> 32))
  ({s. ccap_relation cap' (nodeCap_' s)} \<inter>
  {s. capptr_' s = cptr'} \<inter> {s. unat (n_bits_' s) = guard'}) []
  (resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc)"
  (is "ccorres ?rvr rab_xf ?P ?P' [] ?rab ?rab'") proof (cases "isCNodeCap cap'") case False note Collect_const [simp del] show ?thesis using False apply (cinit' lift: nodeCap_' capptr_' n_bits_') apply csymbr+
      \<comment> \<open>Exception stuff\<close> apply (rule ccorres_split_throws) apply (simp add: Collect_const cap_get_tag_isCap isCap_simps ccorres_cond_iffs
                     resolveAddressBits.simps scast_id) apply (rule ccorres_from_vcg_throws [where P = \<top> and P' = UNIV]) apply (rule allI) apply (rule conseqPre) apply (simp add: throwError_def return_def split) apply vcg apply (clarsimp simp add: exception_defs lookup_fault_lift_def) apply (simp split: if_split) apply (vcg strip_guards=true) apply (clarsimp simp: cap_get_tag_isCap isCap_simps) done next case True note word_neq_0_conv [simp del] from True show ?thesis apply - apply (cinit' simp add: whileAnno_def ucast_id)
    \<comment> \<open>This is done here as init lift usually throws away the relationship between nodeCap_' s and nodeCap.  Normally
      this OK, but the induction messes with everything :(\<close> apply (rule ccorres_abstract [where xf' = nodeCap_']) apply ceqv apply (rename_tac "nodeCap") apply (rule ccorres_abstract [where xf' = n_bits_']) apply ceqv apply (rename_tac "n_bits") apply (rule ccorres_abstract [where xf' = capptr_']) apply ceqv apply (rename_tac "capptr") apply (rule_tac P = "capptr = cptr' \<and> ccap_relation cap' nodeCap" in ccorres_gen_asm2) apply (erule conjE) apply (erule_tac t = capptr in ssubst) apply csymbr+ apply (simp add: cap_get_tag_isCap split del: if_split) apply (thin_tac "ret__unsigned = X" for X) apply (rule ccorres_split_throws [where P = "?P"]) apply (rule_tac P'="{s. nodeCap_' s = nodeCap} \<inter> {s. unat (n_bits_' s) = guard'}"
               in ccorres_inst) apply (rule_tac r' = "?rvr" in
          ccorres_rel_imp [where xf' = rab_xf]) defer apply (case_tac x) apply clarsimp apply clarsimp apply (rule_tac I = "{s. cap_get_tag (nodeCap_' s) = scast cap_cnode_cap}"
         in HoarePartial.While [unfolded whileAnno_def, OF subset_refl]) apply (vcg strip_guards=true) \<comment> \<open>takes a while\<close> apply clarsimp apply simp apply (clarsimp simp: cap_get_tag_isCap)
  \<comment> \<open>Main thm\<close> proof (induct cap' cptr' guard' rule: resolveAddressBits.induct [case_names ind]) case (ind cap cptr guard) note conj_refl = conjI [OF refl refl] have imp_rem: "\<And>P X. P \<Longrightarrow> P \<and> (P \<longrightarrow> X = X)" by clarsimp have imp_rem': "\<And>P R X. P \<and> R \<Longrightarrow> P \<and> R \<and> (P \<and> R \<longrightarrow> X = X)" by clarsimp note conj_refl_r = conjI [OF _ refl] have getSlotCap_in_monad:
      "\<And>a b p rs s. ((a, b) \<in> fst (getSlotCap p s)) =
      (option_map cteCap (ctes_of s p) = Some a
       \<and> b = s)" apply (simp add: getSlotCap_def return_def bind_def objBits_simps split_def) apply rule apply (clarsimp simp: in_getCTE_cte_wp_at' cte_wp_at_ctes_of) apply clarsimp apply (rename_tac s p z) apply (subgoal_tac "cte_wp_at' ((=) z) p s") apply (clarsimp simp: getCTE_def cte_wp_at'_def) apply (simp add: cte_wp_at_ctes_of) done note ih = ind.hyps[simplified, simplified in_monad
        getSlotCap_in_monad locateSlot_conv stateAssert_def, simplified] have gsCNodes: "\<And>s bits p x P Q. bits = capCNodeBits cap \<Longrightarrow> capCNodeBits cap < 32 \<Longrightarrow>
        (case gsCNodes (s \<lparr> gsCNodes := [p \<mapsto> bits ] \<rparr>) p of None \<Rightarrow> False
            | Some n \<Rightarrow> ((n = capCNodeBits cap \<or> Q n))
                \<and> (x && mask bits :: word32) < 2 ^ n) \<or> P" by (clarsimp simp: word_size and_mask_less_size) have case_into_if:
      "\<And>c f g. (case c of CNodeCap _ _ _ _ \<Rightarrow> f | _ \<Rightarrow> g) = (if isCNodeCap c then f else g)" by (case_tac c, simp_all add: isCap_simps) note [split del] = if_split have gbD: "\<And>guardBits cap cap'. \<lbrakk> guardBits = capCNodeGuardSize_CL (cap_cnode_cap_lift cap');
                       ccap_relation cap cap'; isCNodeCap cap \<rbrakk>
           \<Longrightarrow> unat guardBits = capCNodeGuardSize cap \<and> capCNodeGuardSize cap < 32" apply (simp add: cap_get_tag_isCap[symmetric]) apply (frule(1) cap_get_tag_CNodeCap [THEN iffD1]) apply simp apply (simp add: cap_cnode_cap_lift_def cap_lift_cnode_cap) apply (rule order_le_less_trans, rule word_le_nat_alt[THEN iffD1],
              rule word_and_le1) apply (simp add: mask_def) done have cgD: "\<And>capGuard cap cap'. \<lbrakk> capGuard = capCNodeGuard_CL (cap_cnode_cap_lift cap');
        ccap_relation cap cap'; isCNodeCap cap \<rbrakk> \<Longrightarrow> capGuard = capCNodeGuard cap" apply (frule cap_get_tag_CNodeCap [THEN iffD1]) apply (simp add: cap_get_tag_isCap) apply simp done have rbD: "\<And>radixBits cap cap'. \<lbrakk> radixBits = capCNodeRadix_CL (cap_cnode_cap_lift cap');
                       ccap_relation cap cap'; isCNodeCap cap \<rbrakk>
          \<Longrightarrow> unat radixBits = capCNodeBits cap \<and> capCNodeBits cap < 32" apply (simp add: cap_get_tag_isCap[symmetric]) apply (frule(1) cap_get_tag_CNodeCap [THEN iffD1]) apply simp apply (simp add: cap_cnode_cap_lift_def cap_lift_cnode_cap) apply (rule order_le_less_trans, rule word_le_nat_alt[THEN iffD1],
              rule word_and_le1) apply (simp add: mask_def) done have rxgd:
       "\<And>cap cap'. \<lbrakk> ccap_relation cap cap'; isCNodeCap cap \<rbrakk>
          \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')
                      + capCNodeGuardSize_CL (cap_cnode_cap_lift cap'))
              = unat (capCNodeRadix_CL (cap_cnode_cap_lift cap'))
                      + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap'))" apply (simp add: cap_get_tag_isCap[symmetric]) apply (frule(1) cap_get_tag_CNodeCap [THEN iffD1]) apply (simp add: cap_cnode_cap_lift_def cap_lift_cnode_cap) apply (subst unat_plus_simple[symmetric], subst no_olen_add_nat) apply (rule order_le_less_trans, rule add_le_mono) apply (rule word_le_nat_alt[THEN iffD1], rule word_and_le1)+ apply (simp add: mask_def) done 

    (* Move outside this context? *)
     note cap_simps = rxgd cgD [OF refl]
      rbD [OF refl, THEN conjunct1] rbD [OF refl, THEN conjunct2]
      gbD [OF refl, THEN conjunct1] gbD [OF refl, THEN conjunct2] have cond1: "\<And>(nb :: word32) guardBits capGuard.
       \<lbrakk>unat nb = guard; unat guardBits = capCNodeGuardSize cap; capGuard = capCNodeGuard cap;
        guard \<le> 32\<rbrakk>
       \<Longrightarrow> \<forall>s s'.
             (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow>
             (\<not> (capCNodeGuardSize cap \<le> guard \<and>
                 (cptr >> guard - capCNodeGuardSize cap) &&
                 mask (capCNodeGuardSize cap) =
                 capCNodeGuard cap)) =
             (s' \<in> \<lbrace>nb < guardBits \<or>
                    (cptr >> unat (nb - guardBits && 0x1F)) &&
                    2 ^ unat guardBits - 1 \<noteq>  capGuard\<rbrace>)" apply (subst not_le [symmetric]) apply (clarsimp simp: mask_def unat_of_nat Collect_const_mem) apply (cases "capCNodeGuardSize cap = 0") apply (simp add: word_le_nat_alt) apply (subgoal_tac "(0x1F :: word32) = mask 5") apply (erule ssubst [where t = "0x1F"]) apply (simp add: less_mask_eq word_less_nat_alt word_le_nat_alt) apply (subst imp_cong) apply (rule refl) prefer 2 apply (rule refl) apply (subst less_mask_eq) apply (simp add: word_less_nat_alt word_le_nat_alt unat_sub) apply (simp add: word_less_nat_alt word_le_nat_alt unat_sub) apply (simp add: mask_def) done have cond2: "\<And>nb (radixBits :: word32) (guardBits :: word32).
      \<lbrakk> unat nb = guard; unat radixBits = capCNodeBits cap; capCNodeBits cap < 32; capCNodeGuardSize cap < 32;
      unat guardBits = capCNodeGuardSize cap \<rbrakk> \<Longrightarrow>
      \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow>
                (guard < capCNodeBits cap + capCNodeGuardSize cap) = (s' \<in> \<lbrace>nb < radixBits + guardBits\<rbrace>)" by (simp add: Collect_const_mem word_less_nat_alt unat_word_ariths) have cond3: "\<And>nb (radixBits :: word32) (guardBits :: word32).
      \<lbrakk> unat nb = guard; unat radixBits = capCNodeBits cap; capCNodeBits cap < 32; capCNodeGuardSize cap < 32;
      unat guardBits = capCNodeGuardSize cap;
      \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<rbrakk> \<Longrightarrow>
      \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow>
                (guard = capCNodeBits cap + capCNodeGuardSize cap) = (s' \<in> \<lbrace>nb = radixBits + guardBits\<rbrace>)" by clarsimp unat_arith have cond4:
      "\<And>rva nodeCapb ret__unsigned_long.
      \<lbrakk> ccap_relation rva nodeCapb; ret__unsigned_long = cap_get_tag nodeCapb\<rbrakk>
       \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (\<not> isCNodeCap rva) = (s' \<in> \<lbrace>ret__unsigned_long \<noteq> scast cap_cnode_cap\<rbrace>)" by (simp add: cap_get_tag_isCap Collect_const_mem) let ?p = "(capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) &&
                                            mask (capCNodeBits cap)))" have n_bits_guard: "\<And>nb :: word32. \<lbrakk> guard \<le> 32; unat nb = guard \<rbrakk> \<Longrightarrow> unat (nb && mask 6) = guard" apply (subgoal_tac "nb \<le> 32") apply (clarsimp) apply (rule less_mask_eq) apply (erule order_le_less_trans) apply simp apply (simp add: word_le_nat_alt) done have mask6_eqs:
      "\<And>cap ccap. \<lbrakk> ccap_relation cap ccap; isCNodeCap cap \<rbrakk>
             \<Longrightarrow> (capCNodeRadix_CL (cap_cnode_cap_lift ccap) + capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) && mask 6
                 = capCNodeRadix_CL (cap_cnode_cap_lift ccap) + capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)"
      "\<And>cap ccap. \<lbrakk> ccap_relation cap ccap; isCNodeCap cap \<rbrakk>
             \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) && mask 6 = capCNodeRadix_CL (cap_cnode_cap_lift ccap)"
      "\<And>cap ccap. \<lbrakk> ccap_relation cap ccap; isCNodeCap cap \<rbrakk>
             \<Longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) && mask 6 = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)" apply (frule(1) rxgd) defer apply (simp_all add: cap_cnode_cap_lift_def cap_get_tag_isCap[symmetric]
                           cap_lift_cnode_cap) apply (rule less_mask_eq
                 | rule order_le_less_trans, (rule word_and_le1)+
                 | simp add: mask_def)+ apply (simp add: word_less_nat_alt) apply (rule order_le_less_trans, rule add_le_mono) apply (rule word_le_nat_alt[THEN iffD1], rule word_and_le1)+ apply simp done have gm: "\<And>(nb :: word32) cap cap'. \<lbrakk> unat nb = guard; ccap_relation cap cap'; isCNodeCap cap \<rbrakk>
                \<Longrightarrow> nb \<ge> capCNodeRadix_CL (cap_cnode_cap_lift cap') +
                       capCNodeGuardSize_CL (cap_cnode_cap_lift cap')
                     \<longrightarrow> unat (nb -
               (capCNodeRadix_CL (cap_cnode_cap_lift cap') +
                capCNodeGuardSize_CL (cap_cnode_cap_lift cap')))
                    = guard - (capCNodeBits cap + capCNodeGuardSize cap)" apply (simp add: unat_sub) apply (subst unat_plus_simple[THEN iffD1]) apply (subst no_olen_add_nat) apply (simp add: cap_lift_cnode_cap cap_cnode_cap_lift_def
                        cap_get_tag_isCap[symmetric] mask_def) apply (rule order_le_less_trans, rule add_le_mono) apply (rule word_le_nat_alt[THEN iffD1], rule word_and_le1)+ apply simp apply (simp add: cap_simps) done note if_cong[cong] show ?case using ind.prems supply option.case_cong[cong] apply - apply (rule iffD1 [OF ccorres_expand_while_iff]) apply (subst resolveAddressBits.simps) apply (unfold case_into_if) apply (simp add: Let_def ccorres_cond_iffs split del: if_split) apply (rule ccorres_rhs_assoc)+ apply (cinitlift nodeCap_' n_bits_') apply (erule_tac t = nodeCapa in ssubst) apply (rule ccorres_guard_imp2) apply (rule ccorres_gen_asm [where P="0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap"]) apply (rule ccorres_assertE) apply (csymbr | rule iffD2 [OF ccorres_seq_skip])+ apply (rule ccorres_Guard_Seq)+ apply csymbr
       \<comment> \<open>handle the stateAssert in locateSlotCap very carefully\<close> apply (simp(no_asm) only: liftE_bindE[where a="locateSlotCap a b" for a b]) apply (rule ccorres_locateSlotCap_push[rotated]) apply (simp add: unlessE_def) apply (rule hoare_pre, wp, simp)
       \<comment> \<open>Convert guardBits, radixBits and capGuard to their Haskell versions\<close> apply (drule (2) cgD, drule (2) rbD, drule (2) gbD) apply (elim conjE) apply (rule ccorres_gen_asm [where P = "guard \<le> 32"]) apply (rule ccorres_split_unless_throwError_cond [OF cond1], assumption+) apply (rule rab_failure_case_ccorres, vcg, rule conseqPre, vcg) apply clarsimp apply (rule ccorres_locateSlotCap_push[rotated]) apply (rule hoare_pre, wp whenE_throwError_wp, simp) apply (rule ccorres_split_when_throwError_cond [OF cond2], assumption+) apply (rule rab_failure_case_ccorres, vcg, rule conseqPre, vcg) apply clarsimp apply (rule ccorres_Guard_Seq)+ apply csymbr apply csymbr apply (simp only: locateSlotCap_def Let_def if_True) apply (rule ccorres_split_nothrow) apply (rule locateSlotCNode_ccorres[where xf="slot_'" and xfu="slot_'_update"],
                    simp+)[1] apply ceqv apply (rename_tac rv slot) apply (erule_tac t = slot in ssubst) apply (simp del: Collect_const) apply (rule ccorres_if_cond_throws [OF cond3], assumption+) apply (rule ccorres_rhs_assoc)+ apply csymbr+ apply (rule ccorres_return_CE, simp_all)[1] apply (rule ccorres_Guard_Seq) apply (rule ccorres_basic_srnoop2, simp) apply csymbr apply (ctac pre: ccorres_liftE_Seq) apply (rename_tac rva nodeCapa) apply csymbr apply (rule ccorres_if_cond_throws2 [OF cond4], assumption+) apply (rule ccorres_rhs_assoc)+ apply csymbr+ apply (rule ccorres_return_CE, simp_all)[1] apply (frule_tac v1 = rva in iffD1 [OF isCap_simps(4)]) apply (elim exE) apply (rule_tac
                    Q = "\<lambda>s. option_map cteCap (ctes_of s ?p) = Some rva"
                    and F = "\<lambda>s s'.
                    (option_map cteCap (ctes_of s ?p) = Some rva
                    \<and> (ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (Ptr &(Ptr ?p :: cte_C ptr\<rightarrow>[''cap_C'']) :: cap_C ptr))))"
                    in ccorres_req [where Q' = "\<lambda>s'. s' \<Turnstile>\<^sub>c (Ptr ?p :: cte_C ptr)"]) apply (thin_tac "rva = X" for X) apply (clarsimp simp: h_t_valid_clift_Some_iff typ_heap_simps) apply (rule ccte_relation_ccap_relation) apply (erule (2) rf_sr_cte_relation) apply (elim conjE) apply (rule_tac nodeCap1 = "nodeCapa" in ih,
                    (simp | rule conjI refl gsCNodes)+)[1] apply (clarsimp simp: cte_level_bits_def field_simps isCap_simps, fast) apply (rule refl) apply assumption apply assumption apply assumption apply vcg apply (simp add: getSlotCap_def imp_conjR) apply (wp getCTE_ctes_of | (wp (once) hoare_drop_imps))+ apply (clarsimp simp: Collect_const_mem if_then_simps lookup_fault_lifts cong: imp_cong conj_cong) apply vcg apply (vcg strip_guards=true) apply (simp add: locateSlot_conv) apply wp apply vcg apply (vcg strip_guards=true) apply (vcg strip_guards=true) apply (rule conjI)
      \<comment> \<open>Haskell guard\<close> apply (clarsimp simp del: imp_disjL) \<comment> \<open>take a while\<close> apply (intro impI conjI allI) apply fastforce apply clarsimp apply arith apply (clarsimp simp: isCap_simps cte_level_bits_def
                               option.split[where P="\<lambda>x. x"]) apply (clarsimp simp: isCap_simps valid_cap_simps' cte_level_bits_def objBits_defs
                              real_cte_at') apply (clarsimp simp: isCap_simps valid_cap'_def)
       \<comment> \<open>C guard\<close> apply (frule (1) cgD [OF refl], frule (1) rbD [OF refl], frule (1) gbD [OF refl]) apply (simp add: Collect_const_mem cap_get_tag_isCap exception_defs lookup_fault_lifts
        n_bits_guard mask6_eqs word_le_nat_alt word_less_nat_alt gm) apply (elim conjE) apply (frule rf_sr_cte_at_valid [where p =
        "cte_Ptr (capCNodePtr cap + 2^cteSizeBits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))", rotated]) apply simp apply (erule (1) valid_cap_cte_at') apply (simp add: objBits_defs) apply (frule(2) gm) apply (simp add: word_less_nat_alt word_le_nat_alt less_mask_eq) apply (intro impI conjI allI, simp_all) apply (simp add: cap_simps) apply (frule iffD1 [OF cap_get_tag_CNodeCap]) apply (simp add: cap_get_tag_isCap) apply (erule ssubst [where t = cap]) apply simp apply (simp add: mask_def) apply (subgoal_tac "capCNodeBits cap \<noteq> 0") apply (clarsimp simp: linorder_not_less cap_simps) apply (clarsimp simp: isCap_simps valid_cap'_def) apply (clarsimp simp: linorder_not_less cap_simps) apply (clarsimp simp: isCap_simps valid_cap'_def) apply (clarsimp simp: linorder_not_less cap_simps) apply (clarsimp simp: isCap_simps valid_cap'_def) apply arith apply (subgoal_tac "(0x1F :: word32) = mask 5") apply (erule ssubst [where t = "0x1F"]) apply (subst word_mod_2p_is_mask [symmetric]) apply simp apply (simp add: unat_word_ariths) apply (simp add: mask_def) done qed qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc) proof (state)
goal (2 subgoals):
 1. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc)
 2. \<not> isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc) proof (state)
this:
\<not> isCNodeCap cap'

goal (2 subgoals):
 1. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc)
 2. \<not> isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc) proof (state)
this:
\<lbrace>?P\<rbrace> = (if ?P then UNIV else {})

goal (2 subgoals):
 1. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc)
 2. \<not> isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc) proof (prove)
using this:
\<not> isCNodeCap cap'

goal (1 subgoal):
 1. ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>n_bits capptr nodeCap. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q3456 n_bits capptr nodeCap) (?Q'3456 n_bits capptr nodeCap) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
WHILE True DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI
OD))))
 2. \<And>n_bits capptr nodeCap s s'. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> UNIV; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> ?Q3456 n_bits capptr nodeCap s \<and> s' \<in> ?Q'3456 n_bits capptr nodeCap proof (prove)
goal (2 subgoals):
 1. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; \<not> isCNodeCap cap'; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q3456 n_bits capptr nodeCap) (?G'4169 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
WHILE True DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI
OD)
 2. \<And>n_bits capptr nodeCap s s'. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> UNIV; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> ?Q3456 n_bits capptr nodeCap s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s)\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4169 n_bits capptr nodeCap (ret___struct_resolveAddressBits_ret_C_' s) v}}}} proof (prove)
goal (3 subgoals):
 1. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; \<not> isCNodeCap cap'; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q3456 n_bits capptr nodeCap) (?P'4527 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)
 2. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; \<not> isCNodeCap cap'; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4527 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned) IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI {},UNIV
 3. \<And>n_bits capptr nodeCap s s'. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> UNIV; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> ?Q3456 n_bits capptr nodeCap s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s)\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?P'4527 n_bits capptr nodeCap (ret___struct_resolveAddressBits_ret_C_' s) v \<inter> ?R'4527 n_bits capptr nodeCap (ret___struct_resolveAddressBits_ret_C_' s) v}}}} proof (prove)
goal (3 subgoals):
 1. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<forall>v0 v1 v2 v3. cap' \<noteq> capability.CNodeCap v0 v1 v2 v3; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q3456 n_bits cptr' nodeCap) (?P'4527 n_bits cptr' nodeCap ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap)) [SKIP] (throwError Fault_H.lookup_failure.InvalidRoot) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_')
 2. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; \<not> isCNodeCap cap'; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4527 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned) IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI {},UNIV
 3. \<And>n_bits capptr nodeCap s s'. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> UNIV; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> ?Q3456 n_bits capptr nodeCap s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s)\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?P'4527 n_bits capptr nodeCap (ret___struct_resolveAddressBits_ret_C_' s) v \<inter> ?R'4527 n_bits capptr nodeCap (ret___struct_resolveAddressBits_ret_C_' s) v}}}} proof (prove)
goal (3 subgoals):
 1. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<forall>v0 v1 v2 v3. cap' \<noteq> capability.CNodeCap v0 v1 v2 v3; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError Fault_H.lookup_failure.InvalidRoot \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) rv (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' s)}
 2. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; \<not> isCNodeCap cap'; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4527 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned) IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI {},UNIV
 3. \<And>n_bits capptr nodeCap s s'. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> UNIV; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s)\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV \<inter> ?R'4527 n_bits capptr nodeCap (ret___struct_resolveAddressBits_ret_C_' s) v}}}} proof (prove)
goal (3 subgoals):
 1. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned \<sigma>. \<lbrakk>\<forall>v0 v1 v2 v3. cap' \<noteq> capability.CNodeCap v0 v1 v2 v3; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError Fault_H.lookup_failure.InvalidRoot \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) rv (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' s)}
 2. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; \<not> isCNodeCap cap'; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4527 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned) IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI {},UNIV
 3. \<And>n_bits capptr nodeCap s s'. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> UNIV; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s)\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV \<inter> ?R'4527 n_bits capptr nodeCap (ret___struct_resolveAddressBits_ret_C_' s) v}}}} proof (prove)
goal (4 subgoals):
 1. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned \<sigma>. \<lbrakk>\<forall>v0 v1 v2 v3. cap' \<noteq> capability.CNodeCap v0 v1 v2 v3; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'4548 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned \<sigma>) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError Fault_H.lookup_failure.InvalidRoot \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) rv (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' s)}
 2. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned \<sigma>. \<lbrakk>\<forall>v0 v1 v2 v3. cap' \<noteq> capability.CNodeCap v0 v1 v2 v3; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'4548 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned \<sigma>
 3. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; \<not> isCNodeCap cap'; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4527 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned) IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI {},UNIV
 4. \<And>n_bits capptr nodeCap s s'. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> UNIV; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s)\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV \<inter> ?R'4527 n_bits capptr nodeCap (ret___struct_resolveAddressBits_ret_C_' s) v}}}} proof (prove)
goal (4 subgoals):
 1. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned \<sigma>. \<lbrakk>\<forall>v0 v1 v2 v3. cap' \<noteq> capability.CNodeCap v0 v1 v2 v3; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'4548 n_bits cptr' nodeCap ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap) \<sigma>) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},{s. (\<sigma>, s) \<in> rf_sr \<and> resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT \<and> lookup_fault_lift (current_lookup_fault_' (globals s)) = Some Lookup_fault_invalid_root}
 2. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned \<sigma>. \<lbrakk>\<forall>v0 v1 v2 v3. cap' \<noteq> capability.CNodeCap v0 v1 v2 v3; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'4548 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned \<sigma>
 3. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; \<not> isCNodeCap cap'; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4527 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned) IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI {},UNIV
 4. \<And>n_bits capptr nodeCap s s'. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> UNIV; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s)\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV \<inter> ?R'4527 n_bits capptr nodeCap (ret___struct_resolveAddressBits_ret_C_' s) v}}}} proof (prove)
goal (3 subgoals):
 1. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned \<sigma>. \<lbrakk>\<forall>v0 v1 v2 v3. cap' \<noteq> capability.CNodeCap v0 v1 v2 v3; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> (\<sigma>, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)), ret__struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT \<and> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some Lookup_fault_invalid_root}
 2. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; \<not> isCNodeCap cap'; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4527 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned) IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI {},UNIV
 3. \<And>n_bits capptr nodeCap s s'. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> UNIV; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s)\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV \<inter> ?R'4527 n_bits capptr nodeCap (ret___struct_resolveAddressBits_ret_C_' s) v}}}} proof (prove)
goal (2 subgoals):
 1. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; \<not> isCNodeCap cap'; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4527 n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned) IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI {},UNIV
 2. \<And>n_bits capptr nodeCap s s'. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> UNIV; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s)\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV \<inter> ?R'4527 n_bits capptr nodeCap (ret___struct_resolveAddressBits_ret_C_' s) v}}}} proof (prove)
goal (2 subgoals):
 1. \<And>n_bits capptr nodeCap ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; \<not> isCNodeCap cap'; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4527 n_bits cptr' nodeCap ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap)) IF cap_get_tag nodeCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI {},UNIV
 2. \<And>n_bits capptr nodeCap s s'. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> UNIV; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s)\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV \<inter> ?R'4527 n_bits capptr nodeCap (ret___struct_resolveAddressBits_ret_C_' s) v}}}} proof (prove)
goal (1 subgoal):
 1. \<And>n_bits capptr nodeCap s s'. \<lbrakk>\<not> isCNodeCap cap'; unat n_bits = guard'; capptr = cptr'; ccap_relation cap' nodeCap; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> UNIV; \<not> isCNodeCap cap'\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s)\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) (ret___struct_resolveAddressBits_ret_C_' s))\<rparr> \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>(v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> True) \<and> (\<not> v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> False)\<rbrace>}}}} proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc)

goal (1 subgoal):
 1. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc) proof (state)
goal (1 subgoal):
 1. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc) proof (state)
this:
isCNodeCap cap'

goal (1 subgoal):
 1. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc) proof (state)
this:
(?w \<noteq> 0) = (0 < ?w)

goal (1 subgoal):
 1. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc) proof (chain)
picking this:
isCNodeCap cap' proof (prove)
using this:
isCNodeCap cap'

goal (1 subgoal):
 1. ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc) proof (prove)
goal (1 subgoal):
 1. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc) proof (prove)
goal (2 subgoals):
 1. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 ?Q'1225 [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP))))))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> ?Q'1225 proof (prove)
goal (3 subgoals):
 1. \<And>rv' t t'. isCNodeCap cap' \<Longrightarrow> ceqv \<Gamma> nodeCap_' rv' t t' (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP)))))) (?d'1231 rv')
 2. \<And>rv'. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'1231 rv') [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (?d'1231 rv')
 3. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> ?G'1231 (nodeCap_' s)} proof (prove)
goal (2 subgoals):
 1. \<And>rv'. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'1231 rv') [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(rv');;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP))))))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> ?G'1231 (nodeCap_' s)} proof (prove)
goal (2 subgoals):
 1. \<And>nodeCap. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'1231 nodeCap) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP))))))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> ?G'1231 (nodeCap_' s)} proof (prove)
goal (3 subgoals):
 1. \<And>nodeCap rv' t t'. isCNodeCap cap' \<Longrightarrow> ceqv \<Gamma> n_bits_' rv' t t' (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP)))))) (?d'1877 nodeCap rv')
 2. \<And>nodeCap rv'. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'1877 nodeCap rv') [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (?d'1877 nodeCap rv')
 3. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> ?G'1877 (nodeCap_' s) (n_bits_' sa)}} proof (prove)
goal (2 subgoals):
 1. \<And>nodeCap rv'. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'1877 nodeCap rv') [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. rv') \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP))))))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> ?G'1877 (nodeCap_' s) (n_bits_' sa)}} proof (prove)
goal (2 subgoals):
 1. \<And>nodeCap n_bits. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'1877 nodeCap n_bits) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP))))))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> ?G'1877 (nodeCap_' s) (n_bits_' sa)}} proof (prove)
goal (3 subgoals):
 1. \<And>nodeCap n_bits rv' t t'. isCNodeCap cap' \<Longrightarrow> ceqv \<Gamma> capptr_' rv' t t' (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (\<acute>capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP)))))) (?d'2530 nodeCap n_bits rv')
 2. \<And>nodeCap n_bits rv'. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'2530 nodeCap n_bits rv') [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (?d'2530 nodeCap n_bits rv')
 3. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'2530 (nodeCap_' s) (n_bits_' sa) (capptr_' sb)}}} proof (prove)
goal (2 subgoals):
 1. \<And>nodeCap n_bits rv'. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'2530 nodeCap n_bits rv') [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (rv' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (rv' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP))))))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'2530 (nodeCap_' s) (n_bits_' sa) (capptr_' sb)}}} proof (prove)
goal (2 subgoals):
 1. \<And>nodeCap n_bits capptr. isCNodeCap cap' \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'2530 nodeCap n_bits capptr) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP))))))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'2530 (nodeCap_' s) (n_bits_' sa) (capptr_' sb)}}} proof (prove)
goal (2 subgoals):
 1. \<And>nodeCap n_bits capptr. \<lbrakk>isCNodeCap cap'; capptr = cptr' \<and> ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'3259 nodeCap n_bits capptr) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP))))))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'3259 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}} proof (prove)
goal (2 subgoals):
 1. \<And>nodeCap n_bits capptr. \<lbrakk>isCNodeCap cap'; capptr = cptr'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'3259 nodeCap n_bits capptr) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (capptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (capptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP))))))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'3259 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}} proof (prove)
goal (2 subgoals):
 1. \<And>nodeCap n_bits capptr. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'3273 nodeCap n_bits capptr cptr') [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP))))))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'3273 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) (capptr_' sb) \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}} proof (prove)
goal (2 subgoals):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'4129 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(While \<lbrace>True\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>capGuard,UCAST(32 \<rightarrow> 32) \<acute>n_bits,UCAST(32 \<rightarrow> 32) \<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>levelBits,UCAST(32 \<rightarrow> 32) \<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP)))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. sc \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc)\<rparr> \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc))\<rparr> \<in> {sd. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sd)) \<longrightarrow> sd\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4133 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) (capptr_' sb) sc v}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
flex-flex pairs:
\<lambda>nodeCap n_bits capptr. ?G'4133 nodeCap n_bits capptr cptr' \<equiv>\<^sup>? \<lambda>nodeCap n_bits capptr s. ?G'4129 nodeCap n_bits capptr (ret___struct_resolveAddressBits_ret_C_' s) proof (prove)
goal (2 subgoals):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap; ret__unsigned = cap_get_tag nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'4129 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap)) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. sc \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc)\<rparr> \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc))\<rparr> \<in> {sd. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sd)) \<longrightarrow> sd\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4133 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) (capptr_' sb) sc v}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
flex-flex pairs:
\<lambda>nodeCap n_bits capptr. ?G'4133 nodeCap n_bits capptr cptr' \<equiv>\<^sup>? \<lambda>nodeCap n_bits capptr s. ?G'4129 nodeCap n_bits capptr (ret___struct_resolveAddressBits_ret_C_' s) proof (prove)
goal (2 subgoals):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') ?Q1225 (?G'4129 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap)) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI);;
(CALL StrictC'__builtin_unreachable_'proc();;
Guard DontReach {} SKIP))
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1225 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. sc \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc)\<rparr> \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc))\<rparr> \<in> {sd. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sd)) \<longrightarrow> sd\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4133 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) (capptr_' sb) sc v}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
flex-flex pairs:
\<lambda>nodeCap n_bits capptr. ?G'4133 nodeCap n_bits capptr cptr' \<equiv>\<^sup>? \<lambda>nodeCap n_bits capptr s. ?G'4129 nodeCap n_bits capptr (ret___struct_resolveAddressBits_ret_C_' s) proof (prove)
goal (3 subgoals):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (?P'4546 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap)) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 2. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4545 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap)) While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI) {},UNIV
 3. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. sc \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc)\<rparr> \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc))\<rparr> \<in> {sd. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sd)) \<longrightarrow> sd\<lparr>ret__unsigned_' := v\<rparr> \<in> ?P'4548 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) (capptr_' sb) sc v \<inter> ?R'4547 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) (capptr_' sb) sc v}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
flex-flex pairs:
\<lambda>nodeCap n_bits capptr. ?P'4548 nodeCap n_bits capptr cptr' \<equiv>\<^sup>? \<lambda>nodeCap n_bits capptr s. ?P'4546 nodeCap n_bits capptr (ret___struct_resolveAddressBits_ret_C_' s)
\<lambda>nodeCap n_bits capptr. ?R'4547 nodeCap n_bits capptr cptr' \<equiv>\<^sup>? \<lambda>nodeCap n_bits capptr s. ?R'4545 nodeCap n_bits capptr (ret___struct_resolveAddressBits_ret_C_' s) proof (prove)
goal (3 subgoals):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 2. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4545 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap)) While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI) {},UNIV
 3. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. sc \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc)\<rparr> \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc))\<rparr> \<in> {sd. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sd)) \<longrightarrow> sd\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace> \<inter> ?R'4547 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) (capptr_' sb) sc v}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
flex-flex pairs:
\<lambda>nodeCap n_bits capptr. ?R'4547 nodeCap n_bits capptr cptr' \<equiv>\<^sup>? \<lambda>nodeCap n_bits capptr s. ?R'4545 nodeCap n_bits capptr (ret___struct_resolveAddressBits_ret_C_' s) proof (prove)
goal (4 subgoals):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 2. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned x y. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap; (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) x (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' y)\<rbrakk> \<Longrightarrow> (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) x (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' y)
 3. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4545 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap)) While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI) {},UNIV
 4. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. sc \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc)\<rparr> \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc))\<rparr> \<in> {sd. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sd)) \<longrightarrow> sd\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace> \<inter> ?R'4547 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) (capptr_' sb) sc v}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
flex-flex pairs:
\<lambda>nodeCap n_bits capptr. ?R'4547 nodeCap n_bits capptr cptr' \<equiv>\<^sup>? \<lambda>nodeCap n_bits capptr s. ?R'4545 nodeCap n_bits capptr (ret___struct_resolveAddressBits_ret_C_' s) proof (prove)
goal (4 subgoals):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned x y. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap; (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) x (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' y)\<rbrakk> \<Longrightarrow> (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) x (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' y)
 2. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4545 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap)) While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI) {},UNIV
 3. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. sc \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc)\<rparr> \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc))\<rparr> \<in> {sd. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sd)) \<longrightarrow> sd\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace> \<inter> ?R'4547 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) (capptr_' sb) sc v}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
 4. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
flex-flex pairs:
\<lambda>nodeCap n_bits capptr. ?R'4547 nodeCap n_bits capptr cptr' \<equiv>\<^sup>? \<lambda>nodeCap n_bits capptr s. ?R'4545 nodeCap n_bits capptr (ret___struct_resolveAddressBits_ret_C_' s) proof (prove)
goal (5 subgoals):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned x y a. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap; (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) x (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' y); x = Inl a\<rbrakk> \<Longrightarrow> (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) x (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' y)
 2. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned x y b. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap; (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) x (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' y); x = Inr b\<rbrakk> \<Longrightarrow> (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) x (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' y)
 3. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4545 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap)) While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI) {},UNIV
 4. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. sc \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc)\<rparr> \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc))\<rparr> \<in> {sd. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sd)) \<longrightarrow> sd\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace> \<inter> ?R'4547 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) (capptr_' sb) sc v}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
 5. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
flex-flex pairs:
\<lambda>nodeCap n_bits capptr. ?R'4547 nodeCap n_bits capptr cptr' \<equiv>\<^sup>? \<lambda>nodeCap n_bits capptr s. ?R'4545 nodeCap n_bits capptr (ret___struct_resolveAddressBits_ret_C_' s) proof (prove)
goal (4 subgoals):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned x y b. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap; (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) x (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' y); x = Inr b\<rbrakk> \<Longrightarrow> (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) x (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_' y)
 2. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4545 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap)) While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI) {},UNIV
 3. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. sc \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc)\<rparr> \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc))\<rparr> \<in> {sd. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sd)) \<longrightarrow> sd\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace> \<inter> ?R'4547 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) (capptr_' sb) sc v}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
 4. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
flex-flex pairs:
\<lambda>nodeCap n_bits capptr. ?R'4547 nodeCap n_bits capptr cptr' \<equiv>\<^sup>? \<lambda>nodeCap n_bits capptr s. ?R'4545 nodeCap n_bits capptr (ret___struct_resolveAddressBits_ret_C_' s) proof (prove)
goal (3 subgoals):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4545 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C (cap_get_tag nodeCap)) While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI) {},UNIV
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. sc \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc)\<rparr> \<in> {sd. sd\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sc))\<rparr> \<in> {sd. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sd)) \<longrightarrow> sd\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace> \<inter> ?R'4547 (nodeCap_' s) (n_bits_' sa) (capptr_' sb) (capptr_' sb) sc v}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
 3. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
flex-flex pairs:
\<lambda>nodeCap n_bits capptr. ?R'4547 nodeCap n_bits capptr cptr' \<equiv>\<^sup>? \<lambda>nodeCap n_bits capptr s. ?R'4545 nodeCap n_bits capptr (ret___struct_resolveAddressBits_ret_C_' s) proof (prove)
goal (4 subgoals):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (\<lbrace>cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<inter> UNIV) \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI \<lbrace>cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace>,UNIV
 2. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> \<lbrace>cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<inter> - UNIV \<subseteq> {}
 3. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sb. sb \<in> {sc. sc\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sb)\<rparr> \<in> {sc. sc\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sb))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace> \<inter> \<lbrace>cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace>}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
 4. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (4 subgoals):
 1. \<And>nodeCap. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> \<lbrace>cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<inter> UNIV \<subseteq> \<lbrace>cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capCNodeRadix_CL (cap_cnode_cap_lift \<acute>nodeCap) \<longrightarrow> cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capCNodeGuardSize_CL (cap_cnode_cap_lift \<acute>nodeCap) \<longrightarrow> cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capCNodeGuard_CL (cap_cnode_cap_lift \<acute>nodeCap) \<longrightarrow> \<not> (\<acute>n_bits < capCNodeGuardSize_CL (cap_cnode_cap_lift \<acute>nodeCap) \<or> (cptr' >> unat (\<acute>n_bits - capCNodeGuardSize_CL (cap_cnode_cap_lift \<acute>nodeCap) && 0x1F)) && 2 ^ unat (capCNodeGuardSize_CL (cap_cnode_cap_lift \<acute>nodeCap)) - 1 \<noteq> capCNodeGuard_CL (cap_cnode_cap_lift \<acute>nodeCap)) \<longrightarrow> \<not> \<acute>n_bits < capCNodeRadix_CL (cap_cnode_cap_lift \<acute>nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift \<acute>nodeCap) \<longrightarrow> cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap)))\<rbrace>
 2. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> \<lbrace>cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<inter> - UNIV \<subseteq> {}
 3. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sb. sb \<in> {sc. sc\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sb)\<rparr> \<in> {sc. sc\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sb))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace> \<inter> \<lbrace>cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace>}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
 4. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (3 subgoals):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> \<lbrace>cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<inter> - UNIV \<subseteq> {}
 2. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sb. sb \<in> {sc. sc\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sb)\<rparr> \<in> {sc. sc\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sb))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace> \<inter> \<lbrace>cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace>}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
 3. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>isCNodeCap cap'; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap' and (\<lambda>y. guard' \<le> 32)) s; s' \<in> \<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sb. sb \<in> {sc. sc\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sb)\<rparr> \<in> {sc. sc\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (bitsRemaining_C_update (\<lambda>_. n_bits_' sa) (ret___struct_resolveAddressBits_ret_C_' sb))\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace> \<inter> \<lbrace>cap_get_tag \<acute>nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace>}}}} \<inter> \<lbrace>\<^bsup>sb\<^esup>capptr = cptr' \<and> ccap_relation cap' \<^bsup>s\<^esup>nodeCap\<rbrace>}}}
 2. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>isCNodeCap cap'; ccap_relation cap' nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap' cptr' guard') (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr' >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr' >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (state)
goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (state)
this:
\<lbrakk>?x1 = cap; isCNodeCap ?x1; (Inr ?v1, ?s'1) \<in> fst (returnOk (capCNodeBits ?x1) ?s1); (Inr ?rv1, ?st1) \<in> fst (returnOk (capCNodeGuardSize ?x1) ?s'1); (Inr ?rva1, ?sta1) \<in> fst (returnOk (?v1 + ?rv1) ?st1); (Inr ?rvb1, ?stb1) \<in> fst (haskell_assertE (?rva1 \<noteq> 0) [] ?sta1); (Inr ?rvba1, ?stc1) \<in> fst (returnOk (fromCPtr cptr `~shiftR~` (guard - ?rva1) && mask ?v1) ?stb1); (Inr ?rvbb1, ?std1) \<in> fst ((withoutFailure $ locateSlotCap ?x1 ?rvba1) ?stc1); (Inr ?rvbc1, ?ste1) \<in> fst (returnOk (fromCPtr cptr `~shiftR~` (guard - ?rv1) && mask ?rv1) ?std1); (Inr ?rvbd1, ?stf1) \<in> fst ((unlessE (?rv1 \<le> guard \<and> ?rvbc1 = capCNodeGuard ?x1) $ throw $ Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard ?x1) ?rv1) ?ste1); (Inr ?rvc1, ?stg1) \<in> fst ((whenE (guard < ?rva1) $ throw $ Fault_H.lookup_failure.DepthMismatch guard ?rva1) ?stf1); (Inr ?rvd1, ?sth1) \<in> fst (returnOk (guard - ?rva1) ?stg1); ?rvd1 \<noteq> 0; (Inr ?rve1, ?sti1) \<in> fst ((withoutFailure $ getSlotCap ?rvbb1) ?sth1); ?rve1 = capability.CNodeCap ?x111.1 ?x112.1 ?x113.1 ?x114.1; isCNodeCap ?rve1; ccap_relation ?rve1 ?nodeCap1\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' ?rve1 and K (?rvd1 \<le> 32)) (\<lbrace>\<acute>nodeCap = ?nodeCap1\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = ?rvd1\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits ?rve1 cptr ?rvd1) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. ?n_bits1) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ?ret___struct_resolveAddressBits_ret_C1));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. ?n_bits1) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ?ret___struct_resolveAddressBits_ret_C1));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. ?n_bits1) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ?ret___struct_resolveAddressBits_ret_C1));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. ?n_bits1) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ?ret___struct_resolveAddressBits_ret_C1));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
isCNodeCap cap
ccap_relation cap nodeCap

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (state)
this:
?t2 = ?t2 \<and> ?t1 = ?t1

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>P X. P \<Longrightarrow> P \<and> (P \<longrightarrow> X = X) proof (state)
this:
?P1 \<Longrightarrow> ?P1 \<and> (?P1 \<longrightarrow> ?X1 = ?X1)

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>P R X. P \<and> R \<Longrightarrow> P \<and> R \<and> (P \<and> R \<longrightarrow> X = X) proof (state)
this:
?P2 \<and> ?R2 \<Longrightarrow> ?P2 \<and> ?R2 \<and> (?P2 \<and> ?R2 \<longrightarrow> ?X2 = ?X2)

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (state)
this:
?P \<Longrightarrow> ?P \<and> ?t1 = ?t1

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>a b p rs s. ((a, b) \<in> fst (getSlotCap p s)) = (map_option cteCap (ctes_of s p) = Some a \<and> b = s) proof (prove)
goal (1 subgoal):
 1. \<And>a b p s. (\<exists>x\<in>fst (getCTE p s). a = cteCap (fst x) \<and> b = snd x) = ((\<exists>z. ctes_of s p = Some z \<and> cteCap z = a) \<and> b = s) proof (prove)
goal (2 subgoals):
 1. \<And>a b p s. \<exists>x\<in>fst (getCTE p s). a = cteCap (fst x) \<and> b = snd x \<Longrightarrow> (\<exists>z. ctes_of s p = Some z \<and> cteCap z = a) \<and> b = s
 2. \<And>a b p s. (\<exists>z. ctes_of s p = Some z \<and> cteCap z = a) \<and> b = s \<Longrightarrow> \<exists>x\<in>fst (getCTE p s). a = cteCap (fst x) \<and> b = snd x proof (prove)
goal (1 subgoal):
 1. \<And>a b p s. (\<exists>z. ctes_of s p = Some z \<and> cteCap z = a) \<and> b = s \<Longrightarrow> \<exists>x\<in>fst (getCTE p s). a = cteCap (fst x) \<and> b = snd x proof (prove)
goal (1 subgoal):
 1. \<And>b p z. ctes_of b p = Some z \<Longrightarrow> \<exists>x\<in>fst (getCTE p b). cteCap z = cteCap (fst x) \<and> b = snd x proof (prove)
goal (1 subgoal):
 1. \<And>s p z. ctes_of s p = Some z \<Longrightarrow> \<exists>x\<in>fst (getCTE p s). cteCap z = cteCap (fst x) \<and> s = snd x proof (prove)
goal (2 subgoals):
 1. \<And>s p z. \<lbrakk>ctes_of s p = Some z; cte_wp_at' ((=) z) p s\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (getCTE p s). cteCap z = cteCap (fst x) \<and> s = snd x
 2. \<And>s p z. ctes_of s p = Some z \<Longrightarrow> cte_wp_at' ((=) z) p s proof (prove)
goal (1 subgoal):
 1. \<And>s p z. ctes_of s p = Some z \<Longrightarrow> cte_wp_at' ((=) z) p s proof (prove)
goal:
No subgoals! proof (state)
this:
((?a3, ?b3) \<in> fst (getSlotCap ?p3 ?s3)) = (map_option cteCap (ctes_of ?s3 ?p3) = Some ?a3 \<and> ?b3 = ?s3)

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (state)
this:
\<lbrakk>?x1 = cap; isCNodeCap ?x1; ?v1 = capCNodeBits ?x1 \<and> ?s'1 = ?s1; ?rv1 = capCNodeGuardSize ?x1 \<and> ?st1 = ?s'1; ?rva1 = ?v1 + ?rv1 \<and> ?sta1 = ?st1; 0 < ?rva1 \<and> ?stb1 = ?sta1; ?rvba1 = (cptr >> guard - ?rva1) && mask ?v1 \<and> ?stc1 = ?stb1; ((isCNodeCap ?x1 \<or> isZombie ?x1 \<and> capZombieType ?x1 \<noteq> ZombieTCB) \<and> (case gsCNodes ?stc1 (global.capUntypedPtr ?x1) of None \<Rightarrow> False | Some n \<Rightarrow> (isCNodeCap ?x1 \<and> n = capCNodeBits ?x1 \<or> isZombie ?x1 \<and> n = zombieCTEBits (capZombieType ?x1)) \<and> ?rvba1 < 2 ^ n) \<or> isThreadCap ?x1 \<or> isZombie ?x1 \<and> capZombieType ?x1 = ZombieTCB) \<and> ?rvbb1 = global.capUntypedPtr ?x1 + 2 ^ cte_level_bits * ?rvba1 \<and> ?std1 = ?stc1; ?rvbc1 = (cptr >> guard - ?rv1) && mask ?rv1 \<and> ?ste1 = ?std1; ?rv1 \<le> guard \<and> ?rvbc1 = capCNodeGuard ?x1 \<and> (?rv1 \<le> guard \<and> ?rvbc1 = capCNodeGuard ?x1 \<longrightarrow> ?stf1 = ?ste1); \<not> guard < ?rva1 \<and> (\<not> guard < ?rva1 \<longrightarrow> ?stg1 = ?stf1); ?rvd1 = guard - ?rva1 \<and> ?sth1 = ?stg1; 0 < ?rvd1; (\<exists>z. ctes_of ?sth1 ?rvbb1 = Some z \<and> cteCap z = ?rve1) \<and> ?sti1 = ?sth1; ?rve1 = capability.CNodeCap ?x111.1 ?x112.1 ?x113.1 ?x114.1; isCNodeCap ?rve1; ccap_relation ?rve1 ?nodeCap1\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (\<lambda>a. valid_pspace' a \<and> valid_cap' ?rve1 a \<and> ?rvd1 \<le> 32) (\<lbrace>\<acute>nodeCap = ?nodeCap1\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = ?rvd1\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits ?rve1 cptr ?rvd1) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. ?n_bits1) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ?ret___struct_resolveAddressBits_ret_C1));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. ?n_bits1) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ?ret___struct_resolveAddressBits_ret_C1));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. ?n_bits1) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ?ret___struct_resolveAddressBits_ret_C1));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. ?n_bits1) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ?ret___struct_resolveAddressBits_ret_C1));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>s bits p x P Q. \<lbrakk>bits = capCNodeBits cap; capCNodeBits cap < 32\<rbrakk> \<Longrightarrow> (case gsCNodes (s\<lparr>gsCNodes := [p \<mapsto> bits]\<rparr>) p of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits cap \<or> Q n) \<and> x && mask bits < 2 ^ n) \<or> P proof (state)
this:
\<lbrakk>?bits4 = capCNodeBits cap; capCNodeBits cap < 32\<rbrakk> \<Longrightarrow> (case gsCNodes (?s4\<lparr>gsCNodes := [?p4 \<mapsto> ?bits4]\<rparr>) ?p4 of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits cap \<or> ?Q4 n) \<and> ?x4 && mask ?bits4 < 2 ^ n) \<or> ?P4

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>c f g. (case c of capability.CNodeCap x xa xb xc \<Rightarrow> f | _ \<Rightarrow> g) = (if isCNodeCap c then f else g) proof (state)
this:
(case ?c5 of capability.CNodeCap x xa xb xc \<Rightarrow> ?f5 | _ \<Rightarrow> ?g5) = (if isCNodeCap ?c5 then ?f5 else ?g5)

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (state)
this:
?P (if ?Q then ?x else ?y) = ((?Q \<longrightarrow> ?P ?x) \<and> (\<not> ?Q \<longrightarrow> ?P ?y))

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>guardBits cap cap'. \<lbrakk>guardBits = capCNodeGuardSize_CL (cap_cnode_cap_lift cap'); ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> unat guardBits = capCNodeGuardSize cap \<and> capCNodeGuardSize cap < 32 proof (prove)
goal (1 subgoal):
 1. \<And>guardBits cap cap'. \<lbrakk>guardBits = capCNodeGuardSize_CL (cap_cnode_cap_lift cap'); ccap_relation cap cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')) = capCNodeGuardSize cap \<and> capCNodeGuardSize cap < 32 proof (prove)
goal (1 subgoal):
 1. \<And>guardBits cap cap'. \<lbrakk>guardBits = capCNodeGuardSize_CL (cap_cnode_cap_lift cap'); ccap_relation cap cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap')) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap'))) (capCNodeGuard_CL (cap_cnode_cap_lift cap')) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')))\<rbrakk> \<Longrightarrow> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')) = capCNodeGuardSize cap \<and> capCNodeGuardSize cap < 32 proof (prove)
goal (1 subgoal):
 1. \<And>guardBits cap cap'. \<lbrakk>guardBits = capCNodeGuardSize_CL (cap_cnode_cap_lift cap'); ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap')) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap'))) (capCNodeGuard_CL (cap_cnode_cap_lift cap')) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')))) cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap')) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap'))) (capCNodeGuard_CL (cap_cnode_cap_lift cap')) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')))\<rbrakk> \<Longrightarrow> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')) < 32 proof (prove)
goal (1 subgoal):
 1. \<And>guardBits cap cap'. \<lbrakk>guardBits = (cap_C.words_C cap'.[Suc 0] >> 23) && mask 5; ccap_relation (capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))) cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5) < 32 proof (prove)
goal (1 subgoal):
 1. \<And>guardBits cap cap'. \<lbrakk>guardBits = (cap_C.words_C cap'.[Suc 0] >> 23) && mask 5; ccap_relation (capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))) cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))\<rbrakk> \<Longrightarrow> unat (mask 5) < 32 proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>?guardBits6 = capCNodeGuardSize_CL (cap_cnode_cap_lift ?cap'6); ccap_relation ?cap6 ?cap'6; isCNodeCap ?cap6\<rbrakk> \<Longrightarrow> unat ?guardBits6 = capCNodeGuardSize ?cap6 \<and> capCNodeGuardSize ?cap6 < 32

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>capGuard cap cap'. \<lbrakk>capGuard = capCNodeGuard_CL (cap_cnode_cap_lift cap'); ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> capGuard = capCNodeGuard cap proof (prove)
goal (2 subgoals):
 1. \<And>capGuard cap cap'. \<lbrakk>capGuard = capCNodeGuard_CL (cap_cnode_cap_lift cap'); ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap
 2. \<And>capGuard cap cap'. \<lbrakk>capGuard = capCNodeGuard_CL (cap_cnode_cap_lift cap'); ccap_relation cap cap'; isCNodeCap cap; cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap')) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap'))) (capCNodeGuard_CL (cap_cnode_cap_lift cap')) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')))\<rbrakk> \<Longrightarrow> capGuard = capCNodeGuard cap proof (prove)
goal (1 subgoal):
 1. \<And>capGuard cap cap'. \<lbrakk>capGuard = capCNodeGuard_CL (cap_cnode_cap_lift cap'); ccap_relation cap cap'; isCNodeCap cap; cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap')) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap'))) (capCNodeGuard_CL (cap_cnode_cap_lift cap')) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')))\<rbrakk> \<Longrightarrow> capGuard = capCNodeGuard cap proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>?capGuard6 = capCNodeGuard_CL (cap_cnode_cap_lift ?cap'6); ccap_relation ?cap6 ?cap'6; isCNodeCap ?cap6\<rbrakk> \<Longrightarrow> ?capGuard6 = capCNodeGuard ?cap6

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>radixBits cap cap'. \<lbrakk>radixBits = capCNodeRadix_CL (cap_cnode_cap_lift cap'); ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> unat radixBits = capCNodeBits cap \<and> capCNodeBits cap < 32 proof (prove)
goal (1 subgoal):
 1. \<And>radixBits cap cap'. \<lbrakk>radixBits = capCNodeRadix_CL (cap_cnode_cap_lift cap'); ccap_relation cap cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) = capCNodeBits cap \<and> capCNodeBits cap < 32 proof (prove)
goal (1 subgoal):
 1. \<And>radixBits cap cap'. \<lbrakk>radixBits = capCNodeRadix_CL (cap_cnode_cap_lift cap'); ccap_relation cap cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap')) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap'))) (capCNodeGuard_CL (cap_cnode_cap_lift cap')) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')))\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) = capCNodeBits cap \<and> capCNodeBits cap < 32 proof (prove)
goal (1 subgoal):
 1. \<And>radixBits cap cap'. \<lbrakk>radixBits = capCNodeRadix_CL (cap_cnode_cap_lift cap'); ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap')) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap'))) (capCNodeGuard_CL (cap_cnode_cap_lift cap')) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')))) cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap')) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap'))) (capCNodeGuard_CL (cap_cnode_cap_lift cap')) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')))\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) < 32 proof (prove)
goal (1 subgoal):
 1. \<And>radixBits cap cap'. \<lbrakk>radixBits = (cap_C.words_C cap'.[Suc 0] >> 18) && mask 5; ccap_relation (capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))) cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5) < 32 proof (prove)
goal (1 subgoal):
 1. \<And>radixBits cap cap'. \<lbrakk>radixBits = (cap_C.words_C cap'.[Suc 0] >> 18) && mask 5; ccap_relation (capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))) cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))\<rbrakk> \<Longrightarrow> unat (mask 5) < 32 proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>?radixBits6 = capCNodeRadix_CL (cap_cnode_cap_lift ?cap'6); ccap_relation ?cap6 ?cap'6; isCNodeCap ?cap6\<rbrakk> \<Longrightarrow> unat ?radixBits6 = capCNodeBits ?cap6 \<and> capCNodeBits ?cap6 < 32

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cap'. \<lbrakk>ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap')) = unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')) proof (prove)
goal (1 subgoal):
 1. \<And>cap cap'. \<lbrakk>ccap_relation cap cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap')) = unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')) proof (prove)
goal (1 subgoal):
 1. \<And>cap cap'. \<lbrakk>ccap_relation cap cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap')) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap'))) (capCNodeGuard_CL (cap_cnode_cap_lift cap')) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')))\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap')) = unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')) proof (prove)
goal (1 subgoal):
 1. \<And>cap cap'. \<lbrakk>ccap_relation (capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))) cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))\<rbrakk> \<Longrightarrow> unat (((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5) + ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5)) = unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5) + unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5) proof (prove)
goal (1 subgoal):
 1. \<And>cap cap'. \<lbrakk>ccap_relation (capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))) cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5) + unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5) < 2 ^ LENGTH(32) proof (prove)
goal (3 subgoals):
 1. \<And>cap cap'. \<lbrakk>ccap_relation (capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))) cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5) \<le> ?j10 cap cap'
 2. \<And>cap cap'. \<lbrakk>ccap_relation (capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))) cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5) \<le> ?l10 cap cap'
 3. \<And>cap cap'. \<lbrakk>ccap_relation (capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))) cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))\<rbrakk> \<Longrightarrow> ?j10 cap cap' + ?l10 cap cap' < 2 ^ LENGTH(32) proof (prove)
goal (1 subgoal):
 1. \<And>cap cap'. \<lbrakk>ccap_relation (capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))) cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap = capability.CNodeCap (cap_C.words_C cap'.[0] && ~~ mask 5) (unat ((cap_C.words_C cap'.[Suc 0] >> 18) && mask 5)) (cap_C.words_C cap'.[Suc 0] && mask 18) (unat ((cap_C.words_C cap'.[Suc 0] >> 23) && mask 5))\<rbrakk> \<Longrightarrow> unat (mask 5) + unat (mask 5) < 2 ^ LENGTH(32) proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>ccap_relation ?cap6 ?cap'6; isCNodeCap ?cap6\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift ?cap'6) + capCNodeGuardSize_CL (cap_cnode_cap_lift ?cap'6)) = unat (capCNodeRadix_CL (cap_cnode_cap_lift ?cap'6)) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ?cap'6))

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (state)
this:
\<lbrakk>ccap_relation ?cap6 ?cap'6; isCNodeCap ?cap6\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift ?cap'6) + capCNodeGuardSize_CL (cap_cnode_cap_lift ?cap'6)) = unat (capCNodeRadix_CL (cap_cnode_cap_lift ?cap'6)) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ?cap'6))

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (state)
this:
\<lbrakk>ccap_relation ?cap6 ?cap'6; isCNodeCap ?cap6\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift ?cap'6) + capCNodeGuardSize_CL (cap_cnode_cap_lift ?cap'6)) = unat (capCNodeRadix_CL (cap_cnode_cap_lift ?cap'6)) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ?cap'6))
\<lbrakk>ccap_relation ?cap6 ?cap'6; isCNodeCap ?cap6\<rbrakk> \<Longrightarrow> capCNodeGuard_CL (cap_cnode_cap_lift ?cap'6) = capCNodeGuard ?cap6
\<lbrakk>ccap_relation ?cap7 ?cap'7; isCNodeCap ?cap7\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift ?cap'7)) = capCNodeBits ?cap7
\<lbrakk>ccap_relation ?cap7 ?cap'7; isCNodeCap ?cap7\<rbrakk> \<Longrightarrow> capCNodeBits ?cap7 < 32
\<lbrakk>ccap_relation ?cap7 ?cap'7; isCNodeCap ?cap7\<rbrakk> \<Longrightarrow> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ?cap'7)) = capCNodeGuardSize ?cap7
\<lbrakk>ccap_relation ?cap7 ?cap'7; isCNodeCap ?cap7\<rbrakk> \<Longrightarrow> capCNodeGuardSize ?cap7 < 32

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>nb guardBits capGuard. \<lbrakk>unat nb = guard; unat guardBits = capCNodeGuardSize cap; capGuard = capCNodeGuard cap; guard \<le> 32\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (\<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap)) = (s' \<in> \<lbrace>nb < guardBits \<or> (cptr >> unat (nb - guardBits && 0x1F)) && 2 ^ unat guardBits - 1 \<noteq> capGuard\<rbrace>) proof (prove)
goal (1 subgoal):
 1. \<And>nb guardBits capGuard. \<lbrakk>unat nb = guard; unat guardBits = capCNodeGuardSize cap; capGuard = capCNodeGuard cap; guard \<le> 32\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (\<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap)) = (s' \<in> \<lbrace>\<not> guardBits \<le> nb \<or> (cptr >> unat (nb - guardBits && 0x1F)) && 2 ^ unat guardBits - 1 \<noteq> capGuard\<rbrace>) proof (prove)
goal (1 subgoal):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> (cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = (guardBits \<le> nb \<longrightarrow> (cptr >> unat (nb - guardBits && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) proof (prove)
goal (2 subgoals):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap = 0\<rbrakk> \<Longrightarrow> (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> (cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = (guardBits \<le> nb \<longrightarrow> (cptr >> unat (nb - guardBits && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap)
 2. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> (cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = (guardBits \<le> nb \<longrightarrow> (cptr >> unat (nb - guardBits && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) proof (prove)
goal (1 subgoal):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> (cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = (guardBits \<le> nb \<longrightarrow> (cptr >> unat (nb - guardBits && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) proof (prove)
goal (2 subgoals):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0; 0x1F = mask 5\<rbrakk> \<Longrightarrow> (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> (cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = (guardBits \<le> nb \<longrightarrow> (cptr >> unat (nb - guardBits && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap)
 2. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (2 subgoals):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> (cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = (guardBits \<le> nb \<longrightarrow> (cptr >> unat (nb - guardBits && mask 5)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap)
 2. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (2 subgoals):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; 0 < capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> (cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> (cptr >> unat (nb - guardBits && mask 5)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap)
 2. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (4 subgoals):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; 0 < capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> (capCNodeGuardSize cap \<le> unat nb) = ?P'25 nb guardBits s s'
 2. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; 0 < capCNodeGuardSize cap; ?P'25 nb guardBits s s'\<rbrakk> \<Longrightarrow> ((cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = ?Q'25 nb guardBits s s'
 3. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; 0 < capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> (?P'25 nb guardBits s s' \<longrightarrow> ?Q'25 nb guardBits s s') = (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> (cptr >> unat (nb - guardBits && mask 5)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap)
 4. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (3 subgoals):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; 0 < capCNodeGuardSize cap; capCNodeGuardSize cap \<le> unat nb\<rbrakk> \<Longrightarrow> ((cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = ?Q'25 nb guardBits s s'
 2. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; 0 < capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> ?Q'25 nb guardBits s s') = (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> (cptr >> unat (nb - guardBits && mask 5)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap)
 3. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (3 subgoals):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; 0 < capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> ?Q'25 nb guardBits s s') = (capCNodeGuardSize cap \<le> unat nb \<longrightarrow> (cptr >> unat (nb - guardBits && mask 5)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap)
 2. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; 0 < capCNodeGuardSize cap; capCNodeGuardSize cap \<le> unat nb\<rbrakk> \<Longrightarrow> ((cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = ?Q'25 nb guardBits s s'
 3. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (2 subgoals):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; 0 < capCNodeGuardSize cap; capCNodeGuardSize cap \<le> unat nb\<rbrakk> \<Longrightarrow> ((cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = ((cptr >> unat (nb - guardBits && mask 5)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap)
 2. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (3 subgoals):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; 0 < capCNodeGuardSize cap; capCNodeGuardSize cap \<le> unat nb\<rbrakk> \<Longrightarrow> nb - guardBits < 2 ^ 5
 2. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; 0 < capCNodeGuardSize cap; capCNodeGuardSize cap \<le> unat nb\<rbrakk> \<Longrightarrow> ((cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = ((cptr >> unat (nb - guardBits)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap)
 3. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (2 subgoals):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; 0 < capCNodeGuardSize cap; capCNodeGuardSize cap \<le> unat nb\<rbrakk> \<Longrightarrow> ((cptr >> unat nb - capCNodeGuardSize cap) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap) = ((cptr >> unat (nb - guardBits)) && 2 ^ capCNodeGuardSize cap - 1 \<noteq> capCNodeGuard cap)
 2. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (1 subgoal):
 1. \<And>nb guardBits s s'. \<lbrakk>unat guardBits = capCNodeGuardSize cap; unat nb \<le> 32; guard = unat nb; (s, s') \<in> rf_sr; capCNodeGuardSize cap \<noteq> 0\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>unat ?nb6 = guard; unat ?guardBits6 = capCNodeGuardSize cap; ?capGuard6 = capCNodeGuard cap; guard \<le> 32\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (\<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap)) = (s' \<in> \<lbrace>?nb6 < ?guardBits6 \<or> (cptr >> unat (?nb6 - ?guardBits6 && 0x1F)) && 2 ^ unat ?guardBits6 - 1 \<noteq> ?capGuard6\<rbrace>)

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>nb radixBits guardBits. \<lbrakk>unat nb = guard; unat radixBits = capCNodeBits cap; capCNodeBits cap < 32; capCNodeGuardSize cap < 32; unat guardBits = capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (guard < capCNodeBits cap + capCNodeGuardSize cap) = (s' \<in> \<lbrace>nb < radixBits + guardBits\<rbrace>) proof (state)
this:
\<lbrakk>unat ?nb6 = guard; unat ?radixBits6 = capCNodeBits cap; capCNodeBits cap < 32; capCNodeGuardSize cap < 32; unat ?guardBits6 = capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (guard < capCNodeBits cap + capCNodeGuardSize cap) = (s' \<in> \<lbrace>?nb6 < ?radixBits6 + ?guardBits6\<rbrace>)

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>nb radixBits guardBits. \<lbrakk>unat nb = guard; unat radixBits = capCNodeBits cap; capCNodeBits cap < 32; capCNodeGuardSize cap < 32; unat guardBits = capCNodeGuardSize cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (guard = capCNodeBits cap + capCNodeGuardSize cap) = (s' \<in> \<lbrace>nb = radixBits + guardBits\<rbrace>) proof (state)
this:
\<lbrakk>unat ?nb6 = guard; unat ?radixBits6 = capCNodeBits cap; capCNodeBits cap < 32; capCNodeGuardSize cap < 32; unat ?guardBits6 = capCNodeGuardSize cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (guard = capCNodeBits cap + capCNodeGuardSize cap) = (s' \<in> \<lbrace>?nb6 = ?radixBits6 + ?guardBits6\<rbrace>)

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>rva nodeCapb ret__unsigned_long. \<lbrakk>ccap_relation rva nodeCapb; ret__unsigned_long = cap_get_tag nodeCapb\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (\<not> isCNodeCap rva) = (s' \<in> \<lbrace>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace>) proof (state)
this:
\<lbrakk>ccap_relation ?rva6 ?nodeCapb6; ?ret__unsigned_long6 = cap_get_tag ?nodeCapb6\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (\<not> isCNodeCap ?rva6) = (s' \<in> \<lbrace>?ret__unsigned_long6 \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace>)

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (state)
goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>nb. \<lbrakk>guard \<le> 32; unat nb = guard\<rbrakk> \<Longrightarrow> unat (nb && mask 6) = guard proof (prove)
goal (2 subgoals):
 1. \<And>nb. \<lbrakk>guard \<le> 32; unat nb = guard; nb \<le> 0x20\<rbrakk> \<Longrightarrow> unat (nb && mask 6) = guard
 2. \<And>nb. \<lbrakk>guard \<le> 32; unat nb = guard\<rbrakk> \<Longrightarrow> nb \<le> 0x20 proof (prove)
goal (2 subgoals):
 1. \<And>nb. \<lbrakk>unat nb \<le> 32; nb \<le> 0x20; guard = unat nb\<rbrakk> \<Longrightarrow> nb && mask 6 = nb
 2. \<And>nb. \<lbrakk>guard \<le> 32; unat nb = guard\<rbrakk> \<Longrightarrow> nb \<le> 0x20 proof (prove)
goal (2 subgoals):
 1. \<And>nb. \<lbrakk>unat nb \<le> 32; nb \<le> 0x20; guard = unat nb\<rbrakk> \<Longrightarrow> nb < 2 ^ 6
 2. \<And>nb. \<lbrakk>guard \<le> 32; unat nb = guard\<rbrakk> \<Longrightarrow> nb \<le> 0x20 proof (prove)
goal (2 subgoals):
 1. \<And>nb. \<lbrakk>unat nb \<le> 32; guard = unat nb\<rbrakk> \<Longrightarrow> 0x20 < 2 ^ 6
 2. \<And>nb. \<lbrakk>guard \<le> 32; unat nb = guard\<rbrakk> \<Longrightarrow> nb \<le> 0x20 proof (prove)
goal (1 subgoal):
 1. \<And>nb. \<lbrakk>guard \<le> 32; unat nb = guard\<rbrakk> \<Longrightarrow> nb \<le> 0x20 proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>guard \<le> 32; unat ?nb6 = guard\<rbrakk> \<Longrightarrow> unat (?nb6 && mask 6) = guard

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. (\<And>cap ccap. \<lbrakk>ccap_relation cap ccap; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) + capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) && mask 6 = capCNodeRadix_CL (cap_cnode_cap_lift ccap) + capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) &&& (\<And>cap ccap. \<lbrakk>ccap_relation cap ccap; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) && mask 6 = capCNodeRadix_CL (cap_cnode_cap_lift ccap)) &&& (\<And>cap ccap. \<lbrakk>ccap_relation cap ccap; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) && mask 6 = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) proof (prove)
goal (3 subgoals):
 1. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; isCNodeCap cap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap) + capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap))\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) + capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) && mask 6 = capCNodeRadix_CL (cap_cnode_cap_lift ccap) + capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)
 2. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) && mask 6 = capCNodeRadix_CL (cap_cnode_cap_lift ccap)
 3. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) && mask 6 = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) proof (prove)
goal (3 subgoals):
 1. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) && mask 6 = capCNodeRadix_CL (cap_cnode_cap_lift ccap)
 2. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) && mask 6 = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)
 3. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; isCNodeCap cap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap) + capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap))\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) + capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) && mask 6 = capCNodeRadix_CL (cap_cnode_cap_lift ccap) + capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) proof (prove)
goal (3 subgoals):
 1. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) && mask 6 = (cap_C.words_C ccap.[Suc 0] >> 18) && mask 5
 2. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) && mask 6 = (cap_C.words_C ccap.[Suc 0] >> 23) && mask 5
 3. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; unat (((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) + ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)) = unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)\<rbrakk> \<Longrightarrow> ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) + ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) && mask 6 = ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) + ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) proof (prove)
goal (1 subgoal):
 1. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; unat (((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F)) = unat ((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F)\<rbrakk> \<Longrightarrow> ((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F) < 0x40 proof (prove)
goal (1 subgoal):
 1. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; unat (((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F)) = unat ((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F)\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F) < 64 proof (prove)
goal (3 subgoals):
 1. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; unat (((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F)) = unat ((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F)\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) \<le> ?j25 cap ccap
 2. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; unat (((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F)) = unat ((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F)\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F) \<le> ?l25 cap ccap
 3. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; unat (((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F)) = unat ((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F)\<rbrakk> \<Longrightarrow> ?j25 cap ccap + ?l25 cap ccap < 64 proof (prove)
goal (1 subgoal):
 1. \<And>cap ccap. \<lbrakk>ccap_relation cap ccap; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; unat (((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F)) = unat ((cap_C.words_C ccap.[Suc 0] >> 18) && 0x1F) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && 0x1F)\<rbrakk> \<Longrightarrow> unat 0x1F + unat 0x1F < 64 proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>ccap_relation ?cap6 ?ccap6; isCNodeCap ?cap6\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ?ccap6) + capCNodeGuardSize_CL (cap_cnode_cap_lift ?ccap6) && mask 6 = capCNodeRadix_CL (cap_cnode_cap_lift ?ccap6) + capCNodeGuardSize_CL (cap_cnode_cap_lift ?ccap6)
\<lbrakk>ccap_relation ?cap6 ?ccap6; isCNodeCap ?cap6\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ?ccap6) && mask 6 = capCNodeRadix_CL (cap_cnode_cap_lift ?ccap6)
\<lbrakk>ccap_relation ?cap6 ?ccap6; isCNodeCap ?cap6\<rbrakk> \<Longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ?ccap6) && mask 6 = capCNodeGuardSize_CL (cap_cnode_cap_lift ?ccap6)

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap') \<le> nb \<longrightarrow> unat (nb - (capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap'))) = guard - (capCNodeBits cap + capCNodeGuardSize cap) proof (prove)
goal (1 subgoal):
 1. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap') \<le> nb \<longrightarrow> guard - unat (capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap')) = guard - (capCNodeBits cap + capCNodeGuardSize cap) proof (prove)
goal (2 subgoals):
 1. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift cap') \<le> capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap')
 2. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap') \<le> nb \<longrightarrow> guard - (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap'))) = guard - (capCNodeBits cap + capCNodeGuardSize cap) proof (prove)
goal (2 subgoals):
 1. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap')) < 2 ^ LENGTH(32)
 2. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap') \<le> nb \<longrightarrow> guard - (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap'))) = guard - (capCNodeBits cap + capCNodeGuardSize cap) proof (prove)
goal (2 subgoals):
 1. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C cap'.[Suc 0] >> 18) && 0x1F) + unat ((cap_C.words_C cap'.[Suc 0] >> 23) && 0x1F) < 4294967296
 2. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap') \<le> nb \<longrightarrow> guard - (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap'))) = guard - (capCNodeBits cap + capCNodeGuardSize cap) proof (prove)
goal (4 subgoals):
 1. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C cap'.[Suc 0] >> 18) && 0x1F) \<le> ?j10 nb cap cap'
 2. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C cap'.[Suc 0] >> 23) && 0x1F) \<le> ?l10 nb cap cap'
 3. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> ?j10 nb cap cap' + ?l10 nb cap cap' < 4294967296
 4. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap') \<le> nb \<longrightarrow> guard - (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap'))) = guard - (capCNodeBits cap + capCNodeGuardSize cap) proof (prove)
goal (2 subgoals):
 1. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat 0x1F + unat 0x1F < 4294967296
 2. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap') \<le> nb \<longrightarrow> guard - (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap'))) = guard - (capCNodeBits cap + capCNodeGuardSize cap) proof (prove)
goal (1 subgoal):
 1. \<And>nb cap cap'. \<lbrakk>unat nb = guard; ccap_relation cap cap'; isCNodeCap cap\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift cap') + capCNodeGuardSize_CL (cap_cnode_cap_lift cap') \<le> nb \<longrightarrow> guard - (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap')) + unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap'))) = guard - (capCNodeBits cap + capCNodeGuardSize cap) proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>unat ?nb6 = guard; ccap_relation ?cap6 ?cap'6; isCNodeCap ?cap6\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ?cap'6) + capCNodeGuardSize_CL (cap_cnode_cap_lift ?cap'6) \<le> ?nb6 \<longrightarrow> unat (?nb6 - (capCNodeRadix_CL (cap_cnode_cap_lift ?cap'6) + capCNodeGuardSize_CL (cap_cnode_cap_lift ?cap'6))) = guard - (capCNodeBits ?cap6 + capCNodeGuardSize ?cap6)

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (state)
this:
\<lbrakk>?b = ?c; ?c \<Longrightarrow> ?x = ?u; \<not> ?c \<Longrightarrow> ?y = ?v\<rbrakk> \<Longrightarrow> (if ?b then ?x else ?y) = (if ?c then ?u else ?v)

goal (1 subgoal):
 1. \<And>a b c nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 nodeCap n_bits capptr ret___struct_resolveAddressBits_ret_C ret__unsigned. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114; isCNodeCap rve; ccap_relation rve nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' rve and K (rvd \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = rvd\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits rve b rvd) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)); isCNodeCap a; ccap_relation a nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' a and K (c \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = c\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits a b c) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (b >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (b >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap and K (guard \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap cptr guard) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
using this:
isCNodeCap cap
ccap_relation cap nodeCap

goal (1 subgoal):
 1. ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap and K (guard \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap cptr guard) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
using this:
isCNodeCap cap
ccap_relation cap nodeCap

goal (1 subgoal):
 1. ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap and K (guard \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap cptr guard) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap and K (guard \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap cptr guard) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap and K (guard \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap cptr guard) (Cond UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) SKIP) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap and K (guard \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard\<rbrace>) [SKIP] (let nodeCap = cap in if isCNodeCap nodeCap then doE radixBits <- returnOk (capCNodeBits nodeCap);
guardBits <- returnOk (capCNodeGuardSize nodeCap);
levelBits <- returnOk (radixBits + guardBits);
haskell_assertE (levelBits \<noteq> 0) [];
offset <- returnOk (fromCPtr cptr `~shiftR~` (guard - levelBits) && mask radixBits);
slot <- withoutFailure $ locateSlotCap nodeCap offset;
guarda <- returnOk (fromCPtr cptr `~shiftR~` (guard - guardBits) && mask guardBits);
unlessE (guardBits \<le> guard \<and> guarda = capCNodeGuard nodeCap) $ throw $ Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard nodeCap) guardBits;
whenE (guard < levelBits) $ throw $ Fault_H.lookup_failure.DepthMismatch guard levelBits;
bitsLeft <- returnOk (guard - levelBits);
if bitsLeft = 0 then returnOk (slot, 0) else doE nextCap <- withoutFailure $ getSlotCap slot;
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap cptr bitsLeft | _ \<Rightarrow> returnOk (slot, bitsLeft)
odE
odE else throw Fault_H.lookup_failure.InvalidRoot) (Cond UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) SKIP) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap and K (guard \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard\<rbrace>) [SKIP] (let nodeCap = cap in if isCNodeCap nodeCap then doE radixBits <- returnOk (capCNodeBits nodeCap);
guardBits <- returnOk (capCNodeGuardSize nodeCap);
levelBits <- returnOk (radixBits + guardBits);
haskell_assertE (levelBits \<noteq> 0) [];
offset <- returnOk (fromCPtr cptr `~shiftR~` (guard - levelBits) && mask radixBits);
slot <- withoutFailure $ locateSlotCap nodeCap offset;
guarda <- returnOk (fromCPtr cptr `~shiftR~` (guard - guardBits) && mask guardBits);
unlessE (guardBits \<le> guard \<and> guarda = capCNodeGuard nodeCap) $ throw $ Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard nodeCap) guardBits;
whenE (guard < levelBits) $ throw $ Fault_H.lookup_failure.DepthMismatch guard levelBits;
bitsLeft <- returnOk (guard - levelBits);
if bitsLeft = 0 then returnOk (slot, 0) else doE nextCap <- withoutFailure $ getSlotCap slot;
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr bitsLeft else returnOk (slot, bitsLeft)
odE
odE else throw Fault_H.lookup_failure.InvalidRoot) (Cond UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) SKIP) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard\<rbrace>) [SKIP] (doE y <- assertE (0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap);
slot <- liftE (locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)));
y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard\<rbrace>) [SKIP] (doE y <- assertE (0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap);
slot <- liftE (locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)));
y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
(IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa nodeCapa. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; nodeCapa = nodeCap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) UNIV [SKIP] (doE y <- assertE (0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap);
slot <- liftE (locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)));
y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(nodeCapa);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(nodeCapa);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(nodeCapa);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (n_bitsa - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
(IF n_bitsa < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,n_bitsa,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCapa);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - \<acute>levelBits;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa nodeCapa. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) UNIV [SKIP] (doE y <- assertE (0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap);
slot <- liftE (locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)));
y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(nodeCap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(nodeCap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(nodeCap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (n_bitsa - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
(IF n_bitsa < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,n_bitsa,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - \<acute>levelBits;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))))))))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q1259 n_bitsa nodeCapa) (?Q'1259 n_bitsa nodeCapa) [SKIP] (doE y <- assertE (0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap);
slot <- liftE (locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)));
y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(nodeCap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(nodeCap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(nodeCap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (n_bitsa - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
(IF n_bitsa < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,n_bitsa,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - \<acute>levelBits;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))))))))))))
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1259 n_bitsa nodeCapa s \<and> s' \<in> ?Q'1259 n_bitsa nodeCapa proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?G1262 n_bitsa nodeCapa) (?Q'1259 n_bitsa nodeCapa) [SKIP] (doE y <- assertE (0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap);
slot <- liftE (locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)));
y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(nodeCap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(nodeCap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(nodeCap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (n_bitsa - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
(IF n_bitsa < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,n_bitsa,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - \<acute>levelBits;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))))))))))))
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1262 n_bitsa nodeCapa and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> ?Q'1259 n_bitsa nodeCapa proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?G1262 n_bitsa nodeCapa) (?Q'1259 n_bitsa nodeCapa) [SKIP] (doE slot <- liftE (locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)));
y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(nodeCap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(nodeCap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(nodeCap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (n_bitsa - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
(IF n_bitsa < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,n_bitsa,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - \<acute>levelBits;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))))))))))))
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1262 n_bitsa nodeCapa and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> ?Q'1259 n_bitsa nodeCapa proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigneda = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap); ret__unsignedb = capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap); ret__unsigned = capCNodeGuard_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?G1262 n_bitsa nodeCapa) (?G'4611 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (doE slot <- liftE (locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)));
y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE) (Guard ShiftError \<lbrace>ret__unsignedb < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - ret__unsignedb && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (n_bitsa - ret__unsignedb && 0x1F)) && 2 ^ unat ret__unsignedb - 1));;
(IF n_bitsa < ret__unsignedb \<or> \<acute>guard \<noteq> ret__unsigned THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))))))))
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1262 n_bitsa nodeCapa and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> ?G'4611 n_bitsa nodeCapa v va vb}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigneda = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap); ret__unsignedb = capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap); ret__unsigned = capCNodeGuard_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?G1262 n_bitsa nodeCapa) (?C'5443 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (doE slot <- liftE (locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)));
y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE) (\<acute>guard :== (cptr >> unat (n_bitsa - ret__unsignedb && 0x1F)) && 2 ^ unat ret__unsignedb - 1;;
(IF n_bitsa < ret__unsignedb \<or> \<acute>guard \<noteq> ret__unsigned THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))))))))
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1262 n_bitsa nodeCapa and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> ?C'5443 n_bitsa nodeCapa v va vb \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigneda = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap); ret__unsignedb = capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap); ret__unsigned = capCNodeGuard_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?G1262 n_bitsa nodeCapa) (?G'5447 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (doE slot <- liftE (locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)));
y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE) (IF n_bitsa < ret__unsignedb \<or> (cptr >> unat (n_bitsa - ret__unsignedb && 0x1F)) && 2 ^ unat ret__unsignedb - 1 \<noteq> ret__unsigned THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))))
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1262 n_bitsa nodeCapa and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> ?G'5447 n_bitsa nodeCapa v va vb} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigneda = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap); ret__unsignedb = capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap); ret__unsigned = capCNodeGuard_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?G1262 n_bitsa nodeCapa) (?G'5447 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
doE y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE
od) (IF n_bitsa < ret__unsignedb \<or> (cptr >> unat (n_bitsa - ret__unsignedb && 0x1F)) && 2 ^ unat ret__unsignedb - 1 \<noteq> ret__unsigned THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))))
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1262 n_bitsa nodeCapa and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> ?G'5447 n_bitsa nodeCapa v va vb} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (3 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned P. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigneda = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap); ret__unsignedb = capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap); ret__unsigned = capCNodeGuard_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap))) \<lbrace>\<lambda>_. P\<rbrace>, -
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigneda = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap); ret__unsignedb = capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap); ret__unsigned = capCNodeGuard_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?G1262 n_bitsa nodeCapa) (?G'5447 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (doE y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
doE y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE
od
odE) (IF n_bitsa < ret__unsignedb \<or> (cptr >> unat (n_bitsa - ret__unsignedb && 0x1F)) && 2 ^ unat ret__unsignedb - 1 \<noteq> ret__unsigned THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))))
 3. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1262 n_bitsa nodeCapa and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> ?G'5447 n_bitsa nodeCapa v va vb} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (3 subgoals):
 1. \<And>n_bitsa ret__unsigneda ret__unsignedb ret__unsigned P. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigneda = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap); ret__unsignedb = capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap); ret__unsigned = capCNodeGuard_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> if capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap then returnOk () else throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) \<lbrace>\<lambda>_. P\<rbrace>, -
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigneda = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap); ret__unsignedb = capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap); ret__unsigned = capCNodeGuard_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?G1262 n_bitsa nodeCapa) (?G'5447 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (doE y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
doE y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE
od
odE) (IF n_bitsa < ret__unsignedb \<or> (cptr >> unat (n_bitsa - ret__unsignedb && 0x1F)) && 2 ^ unat ret__unsignedb - 1 \<noteq> ret__unsigned THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))))
 3. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1262 n_bitsa nodeCapa and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> ?G'5447 n_bitsa nodeCapa v va vb} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigneda = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap); ret__unsignedb = capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap); ret__unsigned = capCNodeGuard_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?G1262 n_bitsa nodeCapa) (?G'5447 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (doE y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
doE y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE
od
odE) (IF n_bitsa < ret__unsignedb \<or> (cptr >> unat (n_bitsa - ret__unsignedb && 0x1F)) && 2 ^ unat ret__unsignedb - 1 \<noteq> ret__unsigned THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))))
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1262 n_bitsa nodeCapa and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> ?G'5447 n_bitsa nodeCapa v va vb} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap \<and> capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap \<and> capCNodeGuardSize cap < 32\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?G1262 n_bitsa nodeCapa) (?G'5447 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (doE y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
doE y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE
od
odE) (IF n_bitsa < ret__unsignedb \<or> (cptr >> unat (n_bitsa - ret__unsignedb && 0x1F)) && 2 ^ unat ret__unsignedb - 1 \<noteq> ret__unsigned THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))))
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1262 n_bitsa nodeCapa and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> ?G'5447 n_bitsa nodeCapa v va vb} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?G1262 n_bitsa nodeCapa) (?G'5447 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (doE y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
doE y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE
od
odE) (IF n_bitsa < ret__unsignedb \<or> (cptr >> unat (n_bitsa - ret__unsignedb && 0x1F)) && 2 ^ unat ret__unsignedb - 1 \<noteq> ret__unsigned THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))))
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1262 n_bitsa nodeCapa and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> ?G'5447 n_bitsa nodeCapa v va vb} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?G6283 n_bitsa nodeCapa) (?G'5447 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (doE y <- unlessE (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)));
do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
doE y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE
od
odE) (IF n_bitsa < ret__unsignedb \<or> (cptr >> unat (n_bitsa - ret__unsignedb && 0x1F)) && 2 ^ unat ret__unsignedb - 1 \<noteq> ret__unsigned THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))))
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G6283 n_bitsa nodeCapa and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> ?G'5447 n_bitsa nodeCapa v va vb} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?R6299 n_bitsa nodeCapa) (?R'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (throwError (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap))) (\<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_')
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U6300 n_bitsa nodeCapa) (?U'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
doE y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE
od) (IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))))))
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> ?R6299 n_bitsa nodeCapa s) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ?U6300 n_bitsa nodeCapa s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> ?R'6285 n_bitsa nodeCapa v va vb \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> ?U'6285 n_bitsa nodeCapa v va vb)}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned s. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap)\<rbrakk> \<Longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = ret__unsigned && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = ret__unsignedb && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> (s, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) sa) \<in> rf_sr}
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U6300 n_bitsa nodeCapa) (?U'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
doE y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE
od) (IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))))))
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ?U6300 n_bitsa nodeCapa s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> ?U'6285 n_bitsa nodeCapa v va vb)}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (3 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U6300 n_bitsa nodeCapa) (?U'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
doE y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
odE
od) (IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ?U6300 n_bitsa nodeCapa s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> ?U'6285 n_bitsa nodeCapa v va vb)}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned P. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap))) \<lbrace>\<lambda>_. P\<rbrace>, -
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U6300 n_bitsa nodeCapa) (?U'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (doE y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
od
odE) (IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))))))
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ?U6300 n_bitsa nodeCapa s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> ?U'6285 n_bitsa nodeCapa v va vb)}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (3 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U6300 n_bitsa nodeCapa) (?U'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (doE y <- whenE (guard < capCNodeBits cap + capCNodeGuardSize cap) (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)));
do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
od
odE) (IF n_bitsa < ret__unsigneda + ret__unsignedb THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ?U6300 n_bitsa nodeCapa s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> ?U'6285 n_bitsa nodeCapa v va vb)}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; guard < capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?R6373 n_bitsa nodeCapa) (?R'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (throwError (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap))) (\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_')
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U6374 n_bitsa nodeCapa) (?U'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
od) (Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?R6373 n_bitsa nodeCapa s) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U6374 n_bitsa nodeCapa s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> ?R'6362 n_bitsa nodeCapa v va vb \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> ?U'6362 n_bitsa nodeCapa v va vb)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned s. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; guard < capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = ret__unsigneda + ret__unsignedb && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> (s, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) sa) \<in> rf_sr}
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U6374 n_bitsa nodeCapa) (?U'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
od) (Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U6374 n_bitsa nodeCapa s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> ?U'6362 n_bitsa nodeCapa v va vb)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U6374 n_bitsa nodeCapa) (?U'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
od) (Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (Guard ShiftError \<lbrace>n_bitsa - (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U6374 n_bitsa nodeCapa s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> ?U'6362 n_bitsa nodeCapa v va vb)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U6374 n_bitsa nodeCapa) (?C'6430 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
od) (\<acute>offset___unsigned_long :== (cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U6374 n_bitsa nodeCapa s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> ?C'6430 n_bitsa nodeCapa v va vb \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U6374 n_bitsa nodeCapa) (?G'6434 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) [SKIP] (do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
od) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(nodeCap);;
(Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1 = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1) * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U6374 n_bitsa nodeCapa s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> ?G'6434 n_bitsa nodeCapa v va vb} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U6374 n_bitsa nodeCapa) (?G'7174 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned) [SKIP] (do slot <- locateSlotCap cap ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
od) (Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1 = 0 \<or> array_assertion (cte_Ptr ret__unsigned) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (ret__unsigned + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ unat ret__unsigneda - 1) * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U6374 n_bitsa nodeCapa s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> ?G'7174 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U6374 n_bitsa nodeCapa) (?G'7174 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) [SKIP] (do slot <- locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap));
if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE
od) (Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))));;
(IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U6374 n_bitsa nodeCapa s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> ?G'7174 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (8 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ccorres (?r'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned) (?xf'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned) (?P7428 n_bitsa nodeCapa) (?P'7420 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) [SKIP] (locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) (Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv' t t'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned) rv' t t' (IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))) (?d'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv')
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot rv'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); ?r'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot rv'\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot) (?Q'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot rv') [SKIP] (if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (?d'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv')
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>?Q7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. ?r'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (?xf'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned s) \<longrightarrow> s \<in> ?Q'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (?xf'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned s)}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 8. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> (?P7428 n_bitsa nodeCapa and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> ?P'7420 n_bitsa nodeCapa v va vb vc \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv' t t'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> slot_' rv' t t' (IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))) (?d'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv')
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot rv'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); rv' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot) (?Q'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot rv') [SKIP] (if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (?d'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv')
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>?Q7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> ?Q'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s)}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot rv'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); rv' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot) (?Q'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot rv') [SKIP] (if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (slot, 0) else doE nextCap <- liftE (getSlotCap slot);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (slot, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. rv') \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(rv'\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. rv') \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>?Q7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<rbrace>
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> ?Q'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s)}
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv) (?Q'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot) [SKIP] (if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (rv, 0) else doE nextCap <- liftE (getSlotCap rv);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>?Q7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<rbrace>
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> ?Q'7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s)}
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv) (?Q'8151 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot (cte_Ptr rv)) [SKIP] (if guard \<le> capCNodeBits cap + capCNodeGuardSize cap then returnOk (rv, 0) else doE nextCap <- liftE (getSlotCap rv);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>?Q7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<rbrace>
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> ?Q'8151 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)}
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv) (?Q'8151 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) [SKIP] (if guard = capCNodeBits cap + capCNodeGuardSize cap then returnOk (rv, 0) else doE nextCap <- liftE (getSlotCap rv);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (IF n_bitsa = ret__unsigneda + ret__unsignedb THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
(Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>?Q7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<rbrace>
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> ?Q'8151 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)}
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (8 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard = capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?R8188 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv) (?R'8184 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) [SKIP] (returnOk (rv, 0)) (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_')
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv) (?U'8180 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) [SKIP] (doE nextCap <- liftE (getSlotCap rv);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?R8188 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a s) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> ?R'8184 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> ?U'8180 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s))}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 8. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (8 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard = capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?R8188 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv) (?R'8184 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) [SKIP] (returnOk (rv, 0)) (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_')))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv) (?U'8180 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) [SKIP] (doE nextCap <- liftE (getSlotCap rv);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?R8188 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a s) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> ?R'8184 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> ?U'8180 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s))}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 8. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (8 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard = capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?R8188 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv) (?G'8330 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) [SKIP] (returnOk (rv, 0)) (return_C ret__struct_resolveAddressBits_ret_C_'_update (\<lambda>s. bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv) (?U'8180 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) [SKIP] (doE nextCap <- liftE (getSlotCap rv);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?R8188 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a s) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> ?G'8330 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> ?U'8180 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s))}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 8. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv) (?U'8180 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) [SKIP] (doE nextCap <- liftE (getSlotCap rv);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (Guard GhostStateError \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a s)\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> ?U'8180 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s))}}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv) (?C'8381 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) [SKIP] (doE nextCap <- liftE (getSlotCap rv);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (\<acute>globals :== ghost'state_'_update (\<lambda>a. a);;
(\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a s)\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> ?C'8381 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv) (?G'8388 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) [SKIP] (doE nextCap <- liftE (getSlotCap rv);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (\<acute>n_bits :== n_bitsa - (ret__unsigneda + ret__unsignedb);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a s)\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> ?G'8388 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv) (?G'8400 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) [SKIP] (doE nextCap <- liftE (getSlotCap rv);
if isCNodeCap nextCap then CSpace_H.resolveAddressBits nextCap cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))
odE) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ?U8186 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a s)\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> ?G'8400 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (9 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva nodeCapb. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapb\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q9079 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva) (?Q'9079 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva nodeCapb) [SKIP] (if isCNodeCap rva then CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCapb);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>?Q9079 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot\<rbrace>
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> ?Q'9079 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s)}
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 9. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (9 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva nodeCapa. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q9079 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva) (?Q'9079 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva nodeCapa) [SKIP] (if isCNodeCap rva then CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(nodeCapa);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI)))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>?Q9079 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot\<rbrace>
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> ?Q'9079 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s)}
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 9. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (9 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?Q9079 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?G'9730 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (if isCNodeCap rva then CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap)) else returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))) (IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>?Q9079 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot\<rbrace>
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'9730 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v}}
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 9. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (11 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; \<not> isCNodeCap rva\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?R10117 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?R'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))) (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_')
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U10119 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?U'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap))) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 3. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> ?R10117 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a s) and (\<lambda>s. isCNodeCap a \<longrightarrow> ?U10119 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?R'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v)}}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; \<not> isCNodeCap rva\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?R10117 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?R'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))) (\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
(\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
(\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_')))
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U10119 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?U'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap))) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 3. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> ?R10117 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a s) and (\<lambda>s. isCNodeCap a \<longrightarrow> ?U10119 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?R'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v)}}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; \<not> isCNodeCap rva\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?R10117 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?G'10238 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (returnOk (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap))) (return_C ret__struct_resolveAddressBits_ret_C_'_update (\<lambda>s. bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U10119 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?U'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap))) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 3. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> ?R10117 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a s) and (\<lambda>s. isCNodeCap a \<longrightarrow> ?U10119 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> ?G'10238 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v)}}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U10119 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?U'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap))) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> ?U10119 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a s)\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v)}}}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (10 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; \<exists>v0 v1 v2 v3. rva = capability.CNodeCap v0 v1 v2 v3\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U10119 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?U'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap))) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> ?U10119 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a s)\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v)}}}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (10 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?U10119 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?U'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap))) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> ?U10119 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a s)\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v)}}}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (11 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; (s, s') \<in> rf_sr; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rbrakk> \<Longrightarrow> map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva \<and> ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva \<and> ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?P10296 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?P'10297 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap))) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 3. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (?P10296 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?P'10297 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; (s, s') \<in> rf_sr; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rbrakk> \<Longrightarrow> map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva \<and> ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva \<and> ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?P10296 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?P'10297 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap))) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 3. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (?P10296 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?P'10297 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n_bitsa ret__unsigneda ret__unsignedb nodeCapa s s' z v. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; unat ret__unsigneda = capCNodeBits cap; unat ret__unsignedb = capCNodeGuardSize cap; unat n_bitsa \<le> 32; (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation (cteCap z) nodeCapa; isCNodeCap (cteCap z); (s, s') \<in> rf_sr; guard = unat n_bitsa; cslift s' (cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some v; ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z\<rbrakk> \<Longrightarrow> ccap_relation (cteCap z) (cte_C.cap_C v)
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva \<and> ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?P10296 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?P'10297 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap))) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 3. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (?P10296 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?P'10297 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n_bitsa ret__unsigneda ret__unsignedb nodeCapa s s' z v. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; unat ret__unsigneda = capCNodeBits cap; unat ret__unsignedb = capCNodeGuardSize cap; unat n_bitsa \<le> 32; (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation (cteCap z) nodeCapa; isCNodeCap (cteCap z); (s, s') \<in> rf_sr; guard = unat n_bitsa; cslift s' (cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some v; ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z\<rbrakk> \<Longrightarrow> ccte_relation z v
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva \<and> ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?P10296 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?P'10297 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap))) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 3. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (?P10296 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?P'10297 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva \<and> ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?P10296 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?P'10297 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap))) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (?P10296 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?P'10297 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (10 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (?P10296 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva) (?P'10297 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) [SKIP] (CSpace_H.resolveAddressBits rva cptr (guard - (capCNodeBits cap + capCNodeGuardSize cap))) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update (\<lambda>a. a));;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (?P10296 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot a and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?P'10297 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (14 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; unat ret__unsignedb = capCNodeGuardSize cap; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation (capability.CNodeCap v0 v1 v2 v3) nodeCapa; ret__unsigned = cap_get_tag nodeCapa; rva = capability.CNodeCap v0 v1 v2 v3; \<exists>z. ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = capability.CNodeCap v0 v1 v2 v3; ccap_relation (capability.CNodeCap v0 v1 v2 v3) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> \<exists>z. ctes_of (?s10387 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 s s') (global.capUntypedPtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = capability.CNodeCap v0 v1 v2 v3
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; unat ret__unsignedb = capCNodeGuardSize cap; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation (capability.CNodeCap v0 v1 v2 v3) nodeCapa; ret__unsigned = cap_get_tag nodeCapa; rva = capability.CNodeCap v0 v1 v2 v3; \<exists>z. ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = capability.CNodeCap v0 v1 v2 v3; ccap_relation (capability.CNodeCap v0 v1 v2 v3) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ?sti10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 s s' = ?s10387 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 s s'\<lparr>gsCNodes := \<lambda>a. if a = global.capUntypedPtr cap then Some (capCNodeBits cap) else None\<rparr>
 3. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> rva = capability.CNodeCap (?x111.10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s') (?x112.10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s') (?x113.10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s') (?x114.10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s')
 4. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> isCNodeCap rva
 5. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ccap_relation rva nodeCapa
 6. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> ((\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrace> \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10387 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 \<equiv>\<^sup>? \<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10385 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3
\<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10385 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 \<equiv>\<^sup>? \<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10380 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3
\<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10380 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 \<equiv>\<^sup>? \<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10375 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3
\<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10375 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 \<equiv>\<^sup>? \<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10371 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3
\<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10371 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 \<equiv>\<^sup>? \<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10354 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3
\<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10364 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 \<equiv>\<^sup>? \<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10362 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3
\<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10362 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 \<equiv>\<^sup>? \<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10360 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3
\<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10360 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 \<equiv>\<^sup>? \<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10358 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3
\<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10358 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 \<equiv>\<^sup>? \<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10356 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3
\<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10356 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 \<equiv>\<^sup>? \<lambda>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb rv slot nodeCapa v0 v1 v2 v3. ?s10354 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 proof (prove)
goal (13 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; unat ret__unsignedb = capCNodeGuardSize cap; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation (capability.CNodeCap v0 v1 v2 v3) nodeCapa; ret__unsigned = cap_get_tag nodeCapa; rva = capability.CNodeCap v0 v1 v2 v3; \<exists>z. ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = capability.CNodeCap v0 v1 v2 v3; ccap_relation (capability.CNodeCap v0 v1 v2 v3) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ?sti10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (capability.CNodeCap v0 v1 v2 v3) nodeCapa (cap_get_tag nodeCapa) v0 v1 v2 v3 s s' = s\<lparr>gsCNodes := \<lambda>a. if a = global.capUntypedPtr cap then Some (capCNodeBits cap) else None\<rparr>
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> rva = capability.CNodeCap (?x111.10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s') (?x112.10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s') (?x113.10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s') (?x114.10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s')
 3. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> isCNodeCap rva
 4. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ccap_relation rva nodeCapa
 5. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> ((\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrace> \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 10. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> rva = capability.CNodeCap (?x111.10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s') (?x112.10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s') (?x113.10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s') (?x114.10322 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s')
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> isCNodeCap rva
 3. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ccap_relation rva nodeCapa
 4. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> ((\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrace> \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 10. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> isCNodeCap rva
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ccap_relation rva nodeCapa
 3. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> ((\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrace> \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned v0 v1 v2 v3 s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa; isCNodeCap rva; rva = capability.CNodeCap v0 v1 v2 v3; map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some rva; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> ccap_relation rva nodeCapa
 2. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> ((\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrace> \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 9. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 10. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (9 subgoals):
 1. \<And>n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsignedd = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap; ccap_relation rva nodeCapa; ret__unsigned = cap_get_tag nodeCapa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'10106 n_bitsa nodeCapaa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsignedd rv slot rva nodeCapa ret__unsigned) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> ((\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'10106 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot rva (nodeCap_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrace> \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 8. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 9. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (8 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> True) and (\<lambda>s. isCNodeCap a \<longrightarrow> ((\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) and (\<lambda>s. map_option cteCap (ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))) = Some a)) s)\<rbrace>
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrace> \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 8. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (8 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; unat ret__unsignedb = capCNodeGuardSize cap; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<lbrace>?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv\<rbrace> do cte <- getCTE rv;
return (cteCap cte)
od \<lbrace>\<lambda>a b. (isCNodeCap a \<longrightarrow> valid_pspace' b) \<and> (isCNodeCap a \<longrightarrow> valid_cap' a b) \<and> (isCNodeCap a \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (isCNodeCap a \<longrightarrow> (\<exists>z. ctes_of b (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = a))\<rbrace>
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrace> \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R9092 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 8. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap); guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (nodeCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {s. s\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (rv, guard - (capCNodeBits cap + capCNodeGuardSize cap)) of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>nodeCap = \<^bsup>s\<^esup>nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrace> \<inter> {s'. s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))})}}}
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pspace' b \<and> valid_objs' b \<and> (ctes_of b a \<noteq> None \<longrightarrow> (isCNodeCap (cteCap (the (ctes_of b a))) \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (isCNodeCap (cteCap (the (ctes_of b a))) \<longrightarrow> (\<exists>z. ctes_of b (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of b a)))))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; unat ret__unsigneda = capCNodeBits cap; unat ret__unsignedb = capCNodeGuardSize cap; unat n_bitsa \<le> 32; (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap; guard = unat n_bitsa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. (\<exists>rv. ccap_relation rv (nodeCap_' s)) \<longrightarrow> (cap_get_tag (nodeCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (ret__unsigneda + ret__unsignedb)) \<and> n_bitsa - (ret__unsigneda + ret__unsignedb) \<le> 0x20) \<and> (cap_get_tag (nodeCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bits_' s) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))}
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pspace' b \<and> valid_objs' b \<and> (ctes_of b a \<noteq> None \<longrightarrow> (isCNodeCap (cteCap (the (ctes_of b a))) \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (isCNodeCap (cteCap (the (ctes_of b a))) \<longrightarrow> (\<exists>z. ctes_of b (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of b a)))))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> ?R'9086 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s) \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 7. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned rv slot. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) rv slot (cte_Ptr rv)) \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr rv) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pspace' b \<and> valid_objs' b \<and> (ctes_of b a \<noteq> None \<longrightarrow> (isCNodeCap (cteCap (the (ctes_of b a))) \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (isCNodeCap (cteCap (the (ctes_of b a))) \<longrightarrow> (\<exists>z. ctes_of b (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of b a)))))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> ?PT'8182 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned slot (slot_' s) (slot_' s)) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> {sa. (\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slot_' s\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slot_' s\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (ret__unsigneda + ret__unsignedb)) \<and> n_bitsa - (ret__unsigneda + ret__unsignedb) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slot_' s\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bits_' sa) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> sa \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 6. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> locateSlotCNode (capCNodePtr cap) (capCNodeBits cap) ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)) \<lbrace>\<lambda>a. (\<lambda>s. True) and (\<lambda>s. guard = capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pspace' b \<and> valid_objs' b \<and> (ctes_of b a \<noteq> None \<longrightarrow> (isCNodeCap (cteCap (the (ctes_of b a))) \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (isCNodeCap (cteCap (the (ctes_of b a))) \<longrightarrow> (\<exists>z. ctes_of b (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of b a)))))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) s)\<rbrace>
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> {sa. (\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slot_' s\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slot_' s\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (ret__unsigneda + ret__unsignedb)) \<and> n_bitsa - (ret__unsigneda + ret__unsignedb) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slot_' s\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bits_' sa) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> sa \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7426 n_bitsa nodeCapa\<rbrace> do x <- stateAssert (\<lambda>s. case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n) [];
return (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))
od \<lbrace>\<lambda>a aa. guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> valid_pspace' aa \<and> valid_objs' aa \<and> ((\<exists>y. ctes_of aa a = Some y) \<longrightarrow> (isCNodeCap (cteCap (the (ctes_of aa a))) \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (isCNodeCap (cteCap (the (ctes_of aa a))) \<longrightarrow> (\<exists>z. ctes_of aa (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of aa a))))) \<and> cte_wp_at' (\<lambda>_. True) a aa\<rbrace>
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> {sa. (\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slot_' s\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slot_' s\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (ret__unsigneda + ret__unsignedb)) \<and> n_bitsa - (ret__unsigneda + ret__unsignedb) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slot_' s\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bits_' sa) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> sa \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 5. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and ?R7426 n_bitsa nodeCapa) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; True; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsignedc = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> guard < capCNodeBits cap + capCNodeGuardSize cap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7418 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned\<^esub> (?R'7419 n_bitsa nodeCapa ret__unsigneda ret__unsignedb (capCNodeGuard cap) (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) Guard MemorySafety \<lbrace>(cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> unat (n_bitsa - (ret__unsigneda + ret__unsignedb))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>slot. slot_' s = cte_Ptr slot \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C)))\<rparr> \<in> {sa. sa\<lparr>ret___struct_resolveAddressBits_ret_C_' := bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. slot_' s) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))\<rparr> \<in> \<lbrace>resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<^bsup>s\<^esup>slot) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>n_bitsa = ret__unsigneda + ret__unsignedb\<rbrace> \<longrightarrow> sa \<in> {sa. globals_update (ghost'state_'_update (\<lambda>a. a)) sa \<in> {sa. n_bits_'_update (\<lambda>_. n_bitsa - (ret__unsigneda + ret__unsignedb)) sa \<in> \<lbrace>\<^bsup>s\<^esup>slot = \<^bsup>s\<^esup>slot\<rbrace> \<inter> {sa. (\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slot_' s\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slot_' s\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (ret__unsigneda + ret__unsignedb)) \<and> n_bitsa - (ret__unsigneda + ret__unsignedb) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slot_' s\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bits_' sa) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> sa \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>0 < ret__unsigneda + ret__unsignedb\<rbrace>)}}
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 4. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (case gsCNodes a (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n) \<longrightarrow> guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> valid_pspace' a \<and> valid_objs' a \<and> ((\<exists>y. ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y) \<longrightarrow> (isCNodeCap (cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))) \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (isCNodeCap (cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))) \<longrightarrow> (\<exists>z. ctes_of a (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) a)) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vc v'. vc = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vc \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> ?R'7419 n_bitsa nodeCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (3 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32; capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6362 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(ret__unsigneda + ret__unsignedb,n_bitsa);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 2. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 3. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (case gsCNodes a (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n) \<longrightarrow> guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> valid_pspace' a \<and> valid_objs' a \<and> ((\<exists>y. ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y) \<longrightarrow> (isCNodeCap (cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))) \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (isCNodeCap (cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))) \<longrightarrow> (\<exists>z. ctes_of a (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) a)) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6362 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap; ret__unsigned = capCNodeGuard cap; unat ret__unsigneda = capCNodeBits cap; capCNodeBits cap < 32; unat ret__unsignedb = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; guard \<le> 32\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'6285 n_bitsa nodeCapa ret__unsigneda ret__unsignedb ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_guard_mismatch_new_'proc(ret__unsigned,n_bitsa,ret__unsignedb);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_' {},UNIV
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (case gsCNodes a (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n) \<longrightarrow> guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> valid_pspace' a \<and> valid_objs' a \<and> ((\<exists>y. ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y) \<longrightarrow> (isCNodeCap (cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))) \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (isCNodeCap (cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))) \<longrightarrow> (\<exists>z. ctes_of a (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) a)) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> ?PT'6285 n_bitsa nodeCapa v va vb) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (case gsCNodes a (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n) \<longrightarrow> guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> valid_pspace' a \<and> valid_objs' a \<and> ((\<exists>y. ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y) \<longrightarrow> (isCNodeCap (cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))) \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (isCNodeCap (cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))) \<longrightarrow> (\<exists>z. ctes_of a (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) a)) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. True) and (\<lambda>s. \<not> (capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap) \<longrightarrow> True) and (\<lambda>s. capCNodeGuardSize cap \<le> guard \<and> (cptr >> guard - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> ((\<lambda>s. True) and (\<lambda>s. guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> True) and (\<lambda>s. \<not> guard < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (case gsCNodes a (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n) \<longrightarrow> guard \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> valid_pspace' a \<and> valid_objs' a \<and> ((\<exists>y. ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y) \<longrightarrow> (isCNodeCap (cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))) \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (isCNodeCap (cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))) \<longrightarrow> (\<exists>z. ctes_of a (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of a (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) a)) s)) s) and (\<lambda>_. guard \<le> 32) and (\<lambda>_. 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)) s
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32\<rbrakk> \<Longrightarrow> (capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap \<longrightarrow> \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> (case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n) \<longrightarrow> unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap \<longrightarrow> valid_objs' s \<and> ((\<exists>y. ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y) \<longrightarrow> (isCNodeCap (cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))) \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (isCNodeCap (cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))) \<longrightarrow> (\<exists>z. ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) s) \<and> (0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap)
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap; \<exists>y. ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y; isCNodeCap (cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))))\<rbrakk> \<Longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap; \<exists>y. ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y; isCNodeCap (cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))))\<rbrakk> \<Longrightarrow> \<exists>z. ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))
 4. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) s
 5. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32\<rbrakk> \<Longrightarrow> 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap
 6. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap; \<exists>y. ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y; isCNodeCap (cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))))\<rbrakk> \<Longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap; \<exists>y. ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y; isCNodeCap (cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))))\<rbrakk> \<Longrightarrow> \<exists>z. ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) s
 4. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32\<rbrakk> \<Longrightarrow> 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap
 5. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>n_bitsa s s' y. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap; isCNodeCap (cteCap y); ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y\<rbrakk> \<Longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap; \<exists>y. ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y; isCNodeCap (cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))))\<rbrakk> \<Longrightarrow> \<exists>z. ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) s
 4. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32\<rbrakk> \<Longrightarrow> 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap
 5. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap; \<exists>y. ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some y; isCNodeCap (cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))))\<rbrakk> \<Longrightarrow> \<exists>z. ctes_of s (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) = Some z \<and> cteCap z = cteCap (the (ctes_of s (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))))
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) s
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32\<rbrakk> \<Longrightarrow> 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap
 4. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (3 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; capCNodeGuardSize cap \<le> unat n_bitsa \<and> (cptr >> unat n_bitsa - capCNodeGuardSize cap) && mask (capCNodeGuardSize cap) = capCNodeGuard cap; \<not> unat n_bitsa < capCNodeBits cap + capCNodeGuardSize cap; case gsCNodes s (capCNodePtr cap) of None \<Rightarrow> False | Some n \<Rightarrow> n = capCNodeBits cap \<and> (cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) < 2 ^ n; unat n_bitsa \<noteq> capCNodeBits cap + capCNodeGuardSize cap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr cap + 2 ^ cte_level_bits * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) s
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32\<rbrakk> \<Longrightarrow> 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap
 3. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; guard = unat n_bitsa; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32\<rbrakk> \<Longrightarrow> 0 < capCNodeBits cap \<or> 0 < capCNodeGuardSize cap
 2. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa nodeCapa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; (valid_pspace' and valid_cap' cap and (\<lambda>y. guard \<le> 32)) s; s' \<in> UNIV; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap \<and> capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap \<and> capCNodeGuardSize cap < 32\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v v'. v = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. va) s \<in> {s. levelBits_'_update (\<lambda>_. v + va) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. guard_'_update (\<lambda>_. (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1) s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_guard_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>guardFound_CL = vb && mask 32, bitsLeft_CL = n_bitsa && mask 6, bitsFound_CL = va && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.GuardMismatch guard (capCNodeGuard cap) (capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < va \<or> (cptr >> unat (n_bitsa - va && 0x1F)) && 2 ^ unat va - 1 \<noteq> vb\<rbrace> \<longrightarrow> s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = v + va && mask 6, bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C))) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookup_failure_rel (Fault_H.lookup_failure.DepthMismatch guard (capCNodeBits cap + capCNodeGuardSize cap)) (resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C)))) (errstate (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s))} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>n_bitsa < v + va\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>offset___unsigned_long_' := (cptr >> unat (n_bitsa - (v + va))) && 2 ^ unat v - 1\<rparr> \<in> {s. \<forall>vb v'. vb = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. nodeCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>capCNodePtr cap = vb \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1\<rbrace> \<inter> {s. (cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1 = 0 \<or> array_assertion (cte_Ptr vb) (unat ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>slot. cte_Ptr (vb + ((cptr >> unat (n_bitsa - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr slot \<longrightarrow> (n_bitsa = v + va \<longrightarrow> resolveAddressBits_ret_C.status_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (case (slot, 0) of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))), bitsRemaining_C (bitsRemaining_C_update (\<lambda>_. 0) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. cte_Ptr (vb + ((cptr >> unat (v + va - (v + va))) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))) (bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C))))))) \<and> (n_bitsa \<noteq> v + va \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) = unat (n_bitsa - (v + va)) \<and> n_bitsa - (v + va) \<le> 0x20) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> unat (n_bitsa - (v + va)) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) \<and> s \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < v + va))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>n_bitsa - (v + va) < 0x20\<rbrace> \<inter> \<lbrace>v < 0x20\<rbrace>)})}} \<inter> \<lbrace>n_bitsa - va && 0x1F < 0x20\<rbrace> \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. nodeCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' cap s \<and> guard \<le> 32; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap \<and> capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap \<and> capCNodeGuardSize cap < 32\<rbrakk> \<Longrightarrow> (\<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap \<longrightarrow> (guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> (\<exists>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap), bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some (Lookup_fault_depth_mismatch (lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t)))) \<longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap + capCNodeGuardSize cap) \<and> (\<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> capCNodePtr cap = capCNodePtr_CL (cap_cnode_cap_lift nodeCap) \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 \<and> ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0 \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = 0) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> (array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))) \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32)) \<and> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32\<rbrakk> \<Longrightarrow> (\<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap \<longrightarrow> (guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> (\<exists>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap), bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some (Lookup_fault_depth_mismatch (lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t)))) \<longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap + capCNodeGuardSize cap) \<and> (\<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> capCNodePtr cap = capCNodePtr_CL (cap_cnode_cap_lift nodeCap) \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 \<and> ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0 \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = 0) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> (array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))) \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32)) \<and> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32\<rbrakk> \<Longrightarrow> cte_wp_at' (?P10657 n_bitsa s s') (ptr_val (cte_Ptr (capCNodePtr cap + 2 ^ cteSizeBits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) s
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 2 ^ cteSizeBits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rbrakk> \<Longrightarrow> (\<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap \<longrightarrow> (guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> (\<exists>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap), bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some (Lookup_fault_depth_mismatch (lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t)))) \<longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap + capCNodeGuardSize cap) \<and> (\<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> capCNodePtr cap = capCNodePtr_CL (cap_cnode_cap_lift nodeCap) \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 \<and> ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0 \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = 0) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> (array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))) \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32)) \<and> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32\<rbrakk> \<Longrightarrow> cte_wp_at' (?P10657 n_bitsa s s') (capCNodePtr cap + 2 ^ cteSizeBits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))) s
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 2 ^ cteSizeBits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rbrakk> \<Longrightarrow> (\<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap \<longrightarrow> (guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> (\<exists>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap), bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some (Lookup_fault_depth_mismatch (lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t)))) \<longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap + capCNodeGuardSize cap) \<and> (\<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> capCNodePtr cap = capCNodePtr_CL (cap_cnode_cap_lift nodeCap) \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 \<and> ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0 \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = 0) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> (array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))) \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32)) \<and> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 2 ^ cteSizeBits * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rbrakk> \<Longrightarrow> (\<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap \<longrightarrow> (guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> (\<exists>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap), bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some (Lookup_fault_depth_mismatch (lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t)))) \<longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap + capCNodeGuardSize cap) \<and> (\<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> capCNodePtr cap = capCNodePtr_CL (cap_cnode_cap_lift nodeCap) \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 \<and> ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0 \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = 0) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> (array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))) \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))))) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32)) \<and> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap)))\<rbrakk> \<Longrightarrow> (\<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap \<longrightarrow> (guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> (\<exists>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap), bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some (Lookup_fault_depth_mismatch (lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t)))) \<longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap + capCNodeGuardSize cap) \<and> (\<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> capCNodePtr cap = capCNodePtr_CL (cap_cnode_cap_lift nodeCap) \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 \<and> ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0 \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = 0) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C''])))) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> (array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))) \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32)) \<and> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<le> n_bitsa \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> (\<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap \<longrightarrow> (guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> (\<exists>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap), bitsLeft_CL = n_bitsa && mask 6\<rparr> \<and> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some (Lookup_fault_depth_mismatch (lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t)))) \<longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap + capCNodeGuardSize cap) \<and> (\<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> capCNodePtr cap = capCNodePtr_CL (cap_cnode_cap_lift nodeCap) \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 \<and> ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0 \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = 0) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C''])))) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> (array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))) \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32)) \<and> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> (\<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap \<longrightarrow> (guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> (\<exists>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap), bitsLeft_CL = n_bitsa\<rparr> \<and> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some (Lookup_fault_depth_mismatch (lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t)))) \<longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap + capCNodeGuardSize cap) \<and> (\<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<longrightarrow> capCNodePtr cap = capCNodePtr_CL (cap_cnode_cap_lift nodeCap) \<and> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 \<and> ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0 \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = 0) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C''])))) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> (array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))) \<longrightarrow> (n_bitsa = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> (cptr && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)) = ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C))) \<and> (n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) \<longrightarrow> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap) + ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) \<le> 32) \<and> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) \<and> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32)) \<and> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (7 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); \<exists>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap), bitsLeft_CL = n_bitsa\<rparr> \<and> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some (Lookup_fault_depth_mismatch (lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t)))\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap + capCNodeGuardSize cap
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> capCNodePtr cap = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1
 4. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0; n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 5. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))); n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 6. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 7. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (6 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> capCNodePtr cap = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0; n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 4. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))); n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 5. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 6. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (7 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> cap_get_tag nodeCap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap))) (capCNodeGuard_CL (cap_cnode_cap_lift nodeCap)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))\<rbrakk> \<Longrightarrow> capCNodePtr cap = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1
 4. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0; n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 5. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))); n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 6. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 7. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (6 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap))) (capCNodeGuard_CL (cap_cnode_cap_lift nodeCap)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))\<rbrakk> \<Longrightarrow> capCNodePtr cap = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0; n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 4. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))); n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 5. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 6. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (6 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> capCNodePtr (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift nodeCap)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap))) (capCNodeGuard_CL (cap_cnode_cap_lift nodeCap)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)))) = capCNodePtr_CL (cap_cnode_cap_lift nodeCap)
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0; n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 4. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))); n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 5. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 6. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (5 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap) = (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0; n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))); n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 4. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 5. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (4 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0; n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))); n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 4. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (5 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0; n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap); capCNodeBits cap \<noteq> 0\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0; n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> capCNodeBits cap \<noteq> 0
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))); n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 4. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 5. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (4 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); (cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1 = 0; n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> capCNodeBits cap \<noteq> 0
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))); n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 4. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (3 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)); array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))); n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)\<rbrakk> \<Longrightarrow> 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (3 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - capCNodeBits cap) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = unat n_bitsa - capCNodeBits cap; capCNodeGuard cap = 0; capCNodeBits cap \<le> unat n_bitsa; array_assertion (cte_Ptr (capCNodePtr_CL (cap_cnode_cap_lift nodeCap))) (unat ((cptr >> unat n_bitsa - capCNodeBits cap) && 2 ^ capCNodeBits cap - 1)) (hrs_htd (t_hrs_' (globals s'))); n_bitsa \<noteq> capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap); guard = unat n_bitsa; capCNodeGuardSize cap = 0\<rbrakk> \<Longrightarrow> 0 < capCNodeBits cap
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); \<not> guard < capCNodeGuardSize cap \<and> (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; \<not> guard < unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))\<rbrakk> \<Longrightarrow> guard - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; (s, s') \<in> rf_sr; valid_pspace' s; valid_cap' cap s; unat n_bitsa \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap); (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ capCNodeGuardSize cap - 1 = capCNodeGuard cap; capCNodeBits cap + capCNodeGuardSize cap \<le> unat n_bitsa; guard = unat n_bitsa\<rbrakk> \<Longrightarrow> unat n_bitsa - (capCNodeBits cap + capCNodeGuardSize cap) < 32
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa s s' v0 v1 v3. \<lbrakk>ccap_relation (capability.CNodeCap v0 v1 ((cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ v3 - 1) v3) nodeCap; (s, s') \<in> rf_sr; valid_pspace' s; unat n_bitsa \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (v0 + 0x10 * ((cptr >> unat n_bitsa - (v1 + v3)) && mask v1)); unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = unat n_bitsa - (v1 + v3); v1 + v3 \<le> unat n_bitsa; guard = unat n_bitsa; cap = capability.CNodeCap v0 v1 ((cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ v3 - 1) v3; capAligned (capability.CNodeCap v0 v1 ((cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ v3 - 1) v3); 0 < v1; v1 + v3 \<le> word_bits; ((cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ v3 - 1) && mask v3 = (cptr >> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F)) && 2 ^ v3 - 1; \<forall>addr. real_cte_at' (v0 + 2 ^ cteSizeBits * (addr && mask v1)) s\<rbrakk> \<Longrightarrow> unat n_bitsa - (v1 + v3) < 32
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32 proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap); 0x1F = mask 5\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && 0x1F) < 32
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat (n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap) && mask 5) < 32
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (3 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> 0 < 2 ^ 5
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat ((n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) mod 2 ^ 5) < 32
 3. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (2 subgoals):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> unat ((n_bitsa - capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) mod 2 ^ 5) < 32
 2. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal (1 subgoal):
 1. \<And>n_bitsa s s'. \<lbrakk>isCNodeCap cap; ccap_relation cap nodeCap; unat n_bitsa = guard; (s, s') \<in> rf_sr; capCNodeGuard_CL (cap_cnode_cap_lift nodeCap) = capCNodeGuard cap; valid_pspace' s; unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap)) = capCNodeBits cap; capCNodeBits cap < 32; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) = capCNodeGuardSize cap; capCNodeGuardSize cap < 32; valid_cap' cap s; guard \<le> 32; s' \<Turnstile>\<^sub>c cte_Ptr (capCNodePtr cap + 0x10 * ((cptr >> guard - (capCNodeBits cap + capCNodeGuardSize cap)) && mask (capCNodeBits cap))); unat (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap)) \<le> guard \<longrightarrow> unat (n_bitsa - (capCNodeRadix_CL (cap_cnode_cap_lift nodeCap) + capCNodeGuardSize_CL (cap_cnode_cap_lift nodeCap))) = guard - (capCNodeBits cap + capCNodeGuardSize cap)\<rbrakk> \<Longrightarrow> 0x1F = mask 5 proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres (lookup_failure_rel \<currency> (\<lambda>a. case a of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap and K (guard \<le> 32)) (\<lbrace>\<acute>nodeCap = nodeCap\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard\<rbrace>) [SKIP] (CSpace_H.resolveAddressBits cap cptr guard) (While UNIV (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>nodeCap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>nodeCap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>levelBits :== \<acute>radixBits + \<acute>guardBits;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>nodeCap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>guardBits && 0x1F < 0x20\<rbrace> (\<acute>guard :== (cptr >> unat (\<acute>n_bits - \<acute>guardBits && 0x1F)) && 2 ^ unat \<acute>guardBits - 1));;
IF \<acute>n_bits < \<acute>guardBits \<or> \<acute>guard \<noteq> \<acute>capGuard THEN
  CALL lookup_fault_guard_mismatch_new_'proc(\<acute>capGuard,\<acute>n_bits,\<acute>guardBits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
IF \<acute>n_bits < \<acute>levelBits THEN
  CALL lookup_fault_depth_mismatch_new_'proc(\<acute>levelBits,\<acute>n_bits);;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) ret___struct_resolveAddressBits_ret_C));;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard ShiftError \<lbrace>\<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>n_bits - \<acute>levelBits < 0x20\<rbrace> (\<acute>offset___unsigned_long :== (cptr >> unat (\<acute>n_bits - \<acute>levelBits)) && 2 ^ unat \<acute>radixBits - 1));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>nodeCap);;
Guard MemorySafety \<lbrace>\<acute>offset___unsigned_long = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>offset___unsigned_long) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>offset___unsigned_long * word_of_nat (size_of TYPE(cte_C))));;
IF \<acute>n_bits = \<acute>levelBits THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. 0) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI;;
Guard GhostStateError \<lbrace>0 < \<acute>levelBits\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
\<acute>n_bits :== \<acute>n_bits - \<acute>levelBits;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>nodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>nodeCap);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. n_bits) (resolveAddressBits_ret_C.slot_C_update (\<lambda>_. NULL) (resolveAddressBits_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ret___struct_resolveAddressBits_ret_C));;
\<acute>ret___struct_resolveAddressBits_ret_C :== resolveAddressBits_ret_C.slot_C_update (\<lambda>_. \<acute>slot) \<acute>ret___struct_resolveAddressBits_ret_C;;
\<acute>ret___struct_resolveAddressBits_ret_C :== bitsRemaining_C_update (\<lambda>_. \<acute>n_bits) \<acute>ret___struct_resolveAddressBits_ret_C;;
return_C ret__struct_resolveAddressBits_ret_C_'_update ret___struct_resolveAddressBits_ret_C_'
FI))

goal:
No subgoals! proof (state)
this:
ccorres (lookup_failure_rel \<currency> (\<lambda>(cte, bits) (cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20)) (liftxf errstate resolveAddressBits_ret_C.status_C (\<lambda>v. (resolveAddressBits_ret_C.slot_C v, bitsRemaining_C v)) ret__struct_resolveAddressBits_ret_C_') (valid_pspace' and valid_cap' cap' and K (guard' \<le> 32)) (\<lbrace>ccap_relation cap' \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = cptr'\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = guard'\<rbrace>) [] (CSpace_H.resolveAddressBits cap' cptr' guard') (Call resolveAddressBits_'proc)

goal:
No subgoals!