theory CNode_IF

lemma resolve_address_bits_spec_rev:
  "reads_spec_equiv_valid_inv s A aag
     (pas_refined aag and K (is_cnode_cap (fst ref) \<longrightarrow> is_subject aag (obj_ref_of (fst ref))))
     (resolve_address_bits ref)" proof(unfold resolve_address_bits_def, induct ref arbitrary: s rule: resolve_address_bits'.induct) case (1 z cap' cref' s') show ?case apply (subst resolve_address_bits'.simps) apply (cases cap') apply (simp_all add: drop_spec_ev throwError_ev_pre
                              cong: if_cong
                         split del: if_split) apply (wp "1.hyps") apply (assumption | simp add: in_monad | rule conjI)+ apply (wp get_cap_rev get_cap_wp whenE_throwError_wp)+ apply (auto simp: cte_wp_at_caps_of_state is_cap_simps cap_auth_conferred_def
                dest: caps_of_state_pasObjectAbs_eq) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. reads_spec_equiv_valid_inv s A aag (pas_refined aag and K (is_cnode_cap (fst ref) \<longrightarrow> is_subject aag (obj_ref_of (fst ref)))) (resolve_address_bits ref) proof (state)
goal (1 subgoal):
 1. \<And>z cap cref s. (\<And>x61 x62 x63 v s s' rv st rva sta rvb stb rvc stc sa. \<lbrakk>cap = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr v, s') \<in> fst (whenE (\<not> x63 \<le> cref) (throwError $ GuardMismatch (length cref) x63) s); (Inr rv, st) \<in> fst (whenE (length cref < x62 + length x63) (throwError $ DepthMismatch (length cref) (x62 + length x63)) s'); (Inr rva, sta) \<in> fst ((returnOk $ take x62 (drop (length x63) cref)) st); (Inr rvb, stb) \<in> fst ((returnOk $ drop (x62 + length x63) cref) sta); rvb \<noteq> []; (Inr rvc, stc) \<in> fst ((liftE $ get_cap (x61, rva)) stb); is_cnode_cap rvc\<rbrakk> \<Longrightarrow> reads_spec_equiv_valid_inv sa A aag (pas_refined aag and K (is_cnode_cap (fst (rvc, rvb)) \<longrightarrow> is_subject aag (obj_ref_of (fst (rvc, rvb))))) (resolve_address_bits' z (rvc, rvb))) \<Longrightarrow> reads_spec_equiv_valid_inv s A aag (pas_refined aag and K (is_cnode_cap (fst (cap, cref)) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap, cref))))) (resolve_address_bits' z (cap, cref)) proof (state)
this:
\<lbrakk>cap' = CNodeCap ?x61.0 ?x62.0 ?x63.0; ?x62.0 + length ?x63.0 \<noteq> 0; (Inr ?v, ?s') \<in> fst (whenE (\<not> ?x63.0 \<le> cref') (throwError $ GuardMismatch (length cref') ?x63.0) ?s); (Inr ?rv, ?st) \<in> fst (whenE (length cref' < ?x62.0 + length ?x63.0) (throwError $ DepthMismatch (length cref') (?x62.0 + length ?x63.0)) ?s'); (Inr ?rva, ?sta) \<in> fst ((returnOk $ take ?x62.0 (drop (length ?x63.0) cref')) ?st); (Inr ?rvb, ?stb) \<in> fst ((returnOk $ drop (?x62.0 + length ?x63.0) cref') ?sta); ?rvb \<noteq> []; (Inr ?rvc, ?stc) \<in> fst ((liftE $ get_cap (?x61.0, ?rva)) ?stb); is_cnode_cap ?rvc\<rbrakk> \<Longrightarrow> reads_spec_equiv_valid_inv ?sa A aag (pas_refined aag and K (is_cnode_cap (fst (?rvc, ?rvb)) \<longrightarrow> is_subject aag (obj_ref_of (fst (?rvc, ?rvb))))) (resolve_address_bits' z (?rvc, ?rvb))

goal (1 subgoal):
 1. \<And>z cap cref s. (\<And>x61 x62 x63 v s s' rv st rva sta rvb stb rvc stc sa. \<lbrakk>cap = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr v, s') \<in> fst (whenE (\<not> x63 \<le> cref) (throwError $ GuardMismatch (length cref) x63) s); (Inr rv, st) \<in> fst (whenE (length cref < x62 + length x63) (throwError $ DepthMismatch (length cref) (x62 + length x63)) s'); (Inr rva, sta) \<in> fst ((returnOk $ take x62 (drop (length x63) cref)) st); (Inr rvb, stb) \<in> fst ((returnOk $ drop (x62 + length x63) cref) sta); rvb \<noteq> []; (Inr rvc, stc) \<in> fst ((liftE $ get_cap (x61, rva)) stb); is_cnode_cap rvc\<rbrakk> \<Longrightarrow> reads_spec_equiv_valid_inv sa A aag (pas_refined aag and K (is_cnode_cap (fst (rvc, rvb)) \<longrightarrow> is_subject aag (obj_ref_of (fst (rvc, rvb))))) (resolve_address_bits' z (rvc, rvb))) \<Longrightarrow> reads_spec_equiv_valid_inv s A aag (pas_refined aag and K (is_cnode_cap (fst (cap, cref)) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap, cref))))) (resolve_address_bits' z (cap, cref)) proof (prove)
goal (1 subgoal):
 1. reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (resolve_address_bits' z (cap', cref')) proof (prove)
goal (1 subgoal):
 1. reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (case cap' of CNodeCap oref radix_bits guard \<Rightarrow> if radix_bits + length guard = 0 then fail else doE whenE (\<not> guard \<le> cref') (throwError $ GuardMismatch (length cref') guard);
whenE (length cref' < radix_bits + length guard) (throwError $ DepthMismatch (length cref') (radix_bits + length guard));
offset <- returnOk $ take radix_bits (drop (length guard) cref');
rest <- returnOk $ drop (radix_bits + length guard) cref';
if rest = [] then returnOk ((oref, offset), []) else doE next_cap <- liftE $ get_cap (oref, offset);
if is_cnode_cap next_cap then resolve_address_bits' z (next_cap, rest) else returnOk ((oref, offset), rest)
odE
odE | _ \<Rightarrow> throwError InvalidRoot) proof (prove)
goal (12 subgoals):
 1. cap' = NullCap \<Longrightarrow> reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (case cap' of CNodeCap oref radix_bits guard \<Rightarrow> if radix_bits + length guard = 0 then fail else doE whenE (\<not> guard \<le> cref') (throwError $ GuardMismatch (length cref') guard);
whenE (length cref' < radix_bits + length guard) (throwError $ DepthMismatch (length cref') (radix_bits + length guard));
offset <- returnOk $ take radix_bits (drop (length guard) cref');
rest <- returnOk $ drop (radix_bits + length guard) cref';
if rest = [] then returnOk ((oref, offset), []) else doE next_cap <- liftE $ get_cap (oref, offset);
if is_cnode_cap next_cap then resolve_address_bits' z (next_cap, rest) else returnOk ((oref, offset), rest)
odE
odE | _ \<Rightarrow> throwError InvalidRoot)
 2. \<And>x21 x22 x23 x24. cap' = UntypedCap x21 x22 x23 x24 \<Longrightarrow> reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (case cap' of CNodeCap oref radix_bits guard \<Rightarrow> if radix_bits + length guard = 0 then fail else doE whenE (\<not> guard \<le> cref') (throwError $ GuardMismatch (length cref') guard);
whenE (length cref' < radix_bits + length guard) (throwError $ DepthMismatch (length cref') (radix_bits + length guard));
offset <- returnOk $ take radix_bits (drop (length guard) cref');
rest <- returnOk $ drop (radix_bits + length guard) cref';
if rest = [] then returnOk ((oref, offset), []) else doE next_cap <- liftE $ get_cap (oref, offset);
if is_cnode_cap next_cap then resolve_address_bits' z (next_cap, rest) else returnOk ((oref, offset), rest)
odE
odE | _ \<Rightarrow> throwError InvalidRoot)
 3. \<And>x31 x32 x33. cap' = EndpointCap x31 x32 x33 \<Longrightarrow> reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (case cap' of CNodeCap oref radix_bits guard \<Rightarrow> if radix_bits + length guard = 0 then fail else doE whenE (\<not> guard \<le> cref') (throwError $ GuardMismatch (length cref') guard);
whenE (length cref' < radix_bits + length guard) (throwError $ DepthMismatch (length cref') (radix_bits + length guard));
offset <- returnOk $ take radix_bits (drop (length guard) cref');
rest <- returnOk $ drop (radix_bits + length guard) cref';
if rest = [] then returnOk ((oref, offset), []) else doE next_cap <- liftE $ get_cap (oref, offset);
if is_cnode_cap next_cap then resolve_address_bits' z (next_cap, rest) else returnOk ((oref, offset), rest)
odE
odE | _ \<Rightarrow> throwError InvalidRoot)
 4. \<And>x41 x42 x43. cap' = NotificationCap x41 x42 x43 \<Longrightarrow> reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (case cap' of CNodeCap oref radix_bits guard \<Rightarrow> if radix_bits + length guard = 0 then fail else doE whenE (\<not> guard \<le> cref') (throwError $ GuardMismatch (length cref') guard);
whenE (length cref' < radix_bits + length guard) (throwError $ DepthMismatch (length cref') (radix_bits + length guard));
offset <- returnOk $ take radix_bits (drop (length guard) cref');
rest <- returnOk $ drop (radix_bits + length guard) cref';
if rest = [] then returnOk ((oref, offset), []) else doE next_cap <- liftE $ get_cap (oref, offset);
if is_cnode_cap next_cap then resolve_address_bits' z (next_cap, rest) else returnOk ((oref, offset), rest)
odE
odE | _ \<Rightarrow> throwError InvalidRoot)
 5. \<And>x51 x52 x53. cap' = ReplyCap x51 x52 x53 \<Longrightarrow> reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (case cap' of CNodeCap oref radix_bits guard \<Rightarrow> if radix_bits + length guard = 0 then fail else doE whenE (\<not> guard \<le> cref') (throwError $ GuardMismatch (length cref') guard);
whenE (length cref' < radix_bits + length guard) (throwError $ DepthMismatch (length cref') (radix_bits + length guard));
offset <- returnOk $ take radix_bits (drop (length guard) cref');
rest <- returnOk $ drop (radix_bits + length guard) cref';
if rest = [] then returnOk ((oref, offset), []) else doE next_cap <- liftE $ get_cap (oref, offset);
if is_cnode_cap next_cap then resolve_address_bits' z (next_cap, rest) else returnOk ((oref, offset), rest)
odE
odE | _ \<Rightarrow> throwError InvalidRoot)
 6. \<And>x61 x62 x63. cap' = CNodeCap x61 x62 x63 \<Longrightarrow> reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (case cap' of CNodeCap oref radix_bits guard \<Rightarrow> if radix_bits + length guard = 0 then fail else doE whenE (\<not> guard \<le> cref') (throwError $ GuardMismatch (length cref') guard);
whenE (length cref' < radix_bits + length guard) (throwError $ DepthMismatch (length cref') (radix_bits + length guard));
offset <- returnOk $ take radix_bits (drop (length guard) cref');
rest <- returnOk $ drop (radix_bits + length guard) cref';
if rest = [] then returnOk ((oref, offset), []) else doE next_cap <- liftE $ get_cap (oref, offset);
if is_cnode_cap next_cap then resolve_address_bits' z (next_cap, rest) else returnOk ((oref, offset), rest)
odE
odE | _ \<Rightarrow> throwError InvalidRoot)
 7. \<And>x7. cap' = ThreadCap x7 \<Longrightarrow> reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (case cap' of CNodeCap oref radix_bits guard \<Rightarrow> if radix_bits + length guard = 0 then fail else doE whenE (\<not> guard \<le> cref') (throwError $ GuardMismatch (length cref') guard);
whenE (length cref' < radix_bits + length guard) (throwError $ DepthMismatch (length cref') (radix_bits + length guard));
offset <- returnOk $ take radix_bits (drop (length guard) cref');
rest <- returnOk $ drop (radix_bits + length guard) cref';
if rest = [] then returnOk ((oref, offset), []) else doE next_cap <- liftE $ get_cap (oref, offset);
if is_cnode_cap next_cap then resolve_address_bits' z (next_cap, rest) else returnOk ((oref, offset), rest)
odE
odE | _ \<Rightarrow> throwError InvalidRoot)
 8. cap' = DomainCap \<Longrightarrow> reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (case cap' of CNodeCap oref radix_bits guard \<Rightarrow> if radix_bits + length guard = 0 then fail else doE whenE (\<not> guard \<le> cref') (throwError $ GuardMismatch (length cref') guard);
whenE (length cref' < radix_bits + length guard) (throwError $ DepthMismatch (length cref') (radix_bits + length guard));
offset <- returnOk $ take radix_bits (drop (length guard) cref');
rest <- returnOk $ drop (radix_bits + length guard) cref';
if rest = [] then returnOk ((oref, offset), []) else doE next_cap <- liftE $ get_cap (oref, offset);
if is_cnode_cap next_cap then resolve_address_bits' z (next_cap, rest) else returnOk ((oref, offset), rest)
odE
odE | _ \<Rightarrow> throwError InvalidRoot)
 9. cap' = IRQControlCap \<Longrightarrow> reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (case cap' of CNodeCap oref radix_bits guard \<Rightarrow> if radix_bits + length guard = 0 then fail else doE whenE (\<not> guard \<le> cref') (throwError $ GuardMismatch (length cref') guard);
whenE (length cref' < radix_bits + length guard) (throwError $ DepthMismatch (length cref') (radix_bits + length guard));
offset <- returnOk $ take radix_bits (drop (length guard) cref');
rest <- returnOk $ drop (radix_bits + length guard) cref';
if rest = [] then returnOk ((oref, offset), []) else doE next_cap <- liftE $ get_cap (oref, offset);
if is_cnode_cap next_cap then resolve_address_bits' z (next_cap, rest) else returnOk ((oref, offset), rest)
odE
odE | _ \<Rightarrow> throwError InvalidRoot)
 10. \<And>x10. cap' = IRQHandlerCap x10 \<Longrightarrow> reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (case cap' of CNodeCap oref radix_bits guard \<Rightarrow> if radix_bits + length guard = 0 then fail else doE whenE (\<not> guard \<le> cref') (throwError $ GuardMismatch (length cref') guard);
whenE (length cref' < radix_bits + length guard) (throwError $ DepthMismatch (length cref') (radix_bits + length guard));
offset <- returnOk $ take radix_bits (drop (length guard) cref');
rest <- returnOk $ drop (radix_bits + length guard) cref';
if rest = [] then returnOk ((oref, offset), []) else doE next_cap <- liftE $ get_cap (oref, offset);
if is_cnode_cap next_cap then resolve_address_bits' z (next_cap, rest) else returnOk ((oref, offset), rest)
odE
odE | _ \<Rightarrow> throwError InvalidRoot)
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<And>x61 x62 x63. cap' = CNodeCap x61 x62 x63 \<Longrightarrow> reads_spec_equiv_valid_inv s' A aag (pas_refined aag and (\<lambda>y. is_subject aag x61)) (if x62 = 0 \<and> x63 = [] then fail else doE y <- whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63));
y <- whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63)));
if length cref' \<le> x62 + length x63 then returnOk ((x61, drop (length x63) cref'), []) else doE next_cap <- liftE (get_cap (x61, take x62 (drop (length x63) cref')));
if is_cnode_cap next_cap then resolve_address_bits' z (next_cap, drop (x62 + length x63) cref') else returnOk ((x61, take x62 (drop (length x63) cref')), drop (x62 + length x63) cref')
odE
odE) proof (prove)
goal (16 subgoals):
 1. \<And>x61 x62 x63 rv s'' rva s''a rvb s''b. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s'); (Inr rva, s''a) \<in> fst (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) s''); \<not> length cref' \<le> x62 + length x63; (Inr rvb, s''b) \<in> fst (liftE (get_cap (x61, take x62 (drop (length x63) cref'))) s''a); is_cnode_cap rvb\<rbrakk> \<Longrightarrow> x62 + length x63 \<noteq> 0
 2. \<And>x61 x62 x63 rv s'' rva s''a rvb s''b. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s'); (Inr rva, s''a) \<in> fst (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) s''); \<not> length cref' \<le> x62 + length x63; (Inr rvb, s''b) \<in> fst (liftE (get_cap (x61, take x62 (drop (length x63) cref'))) s''a); is_cnode_cap rvb\<rbrakk> \<Longrightarrow> (Inr (?v50 x61 x62 x63 rv s'' rva s''a rvb s''b), ?s'50 x61 x62 x63 rv s'' rva s''a rvb s''b) \<in> fst (whenE (\<not> x63 \<le> cref') (throwError $ GuardMismatch (length cref') x63) (?s50 x61 x62 x63 rv s'' rva s''a rvb s''b))
 3. \<And>x61 x62 x63 rv s'' rva s''a rvb s''b. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s'); (Inr rva, s''a) \<in> fst (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) s''); \<not> length cref' \<le> x62 + length x63; (Inr rvb, s''b) \<in> fst (liftE (get_cap (x61, take x62 (drop (length x63) cref'))) s''a); is_cnode_cap rvb\<rbrakk> \<Longrightarrow> (Inr (?rv50 x61 x62 x63 rv s'' rva s''a rvb s''b), ?st50 x61 x62 x63 rv s'' rva s''a rvb s''b) \<in> fst (whenE (length cref' < x62 + length x63) (throwError $ DepthMismatch (length cref') (x62 + length x63)) (?s'50 x61 x62 x63 rv s'' rva s''a rvb s''b))
 4. \<And>x61 x62 x63 rv s'' rva s''a rvb s''b. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s'); (Inr rva, s''a) \<in> fst (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) s''); \<not> length cref' \<le> x62 + length x63; (Inr rvb, s''b) \<in> fst (liftE (get_cap (x61, take x62 (drop (length x63) cref'))) s''a); is_cnode_cap rvb\<rbrakk> \<Longrightarrow> (Inr (?rva50 x61 x62 x63 rv s'' rva s''a rvb s''b), ?sta50 x61 x62 x63 rv s'' rva s''a rvb s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref')) (?st50 x61 x62 x63 rv s'' rva s''a rvb s''b))
 5. \<And>x61 x62 x63 rv s'' rva s''a rvb s''b. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s'); (Inr rva, s''a) \<in> fst (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) s''); \<not> length cref' \<le> x62 + length x63; (Inr rvb, s''b) \<in> fst (liftE (get_cap (x61, take x62 (drop (length x63) cref'))) s''a); is_cnode_cap rvb\<rbrakk> \<Longrightarrow> (Inr (drop (x62 + length x63) cref'), ?stb50 x61 x62 x63 rv s'' rva s''a rvb s''b) \<in> fst ((returnOk $ drop (x62 + length x63) cref') (?sta50 x61 x62 x63 rv s'' rva s''a rvb s''b))
 6. \<And>x61 x62 x63 rv s'' rva s''a rvb s''b. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s'); (Inr rva, s''a) \<in> fst (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) s''); \<not> length cref' \<le> x62 + length x63; (Inr rvb, s''b) \<in> fst (liftE (get_cap (x61, take x62 (drop (length x63) cref'))) s''a); is_cnode_cap rvb\<rbrakk> \<Longrightarrow> drop (x62 + length x63) cref' \<noteq> []
 7. \<And>x61 x62 x63 rv s'' rva s''a rvb s''b. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s'); (Inr rva, s''a) \<in> fst (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) s''); \<not> length cref' \<le> x62 + length x63; (Inr rvb, s''b) \<in> fst (liftE (get_cap (x61, take x62 (drop (length x63) cref'))) s''a); is_cnode_cap rvb\<rbrakk> \<Longrightarrow> (Inr rvb, ?stc50 x61 x62 x63 rv s'' rva s''a rvb s''b) \<in> fst ((liftE $ get_cap (x61, ?rva50 x61 x62 x63 rv s'' rva s''a rvb s''b)) (?stb50 x61 x62 x63 rv s'' rva s''a rvb s''b))
 8. \<And>x61 x62 x63 rv s'' rva s''a rvb s''b. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s'); (Inr rva, s''a) \<in> fst (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) s''); \<not> length cref' \<le> x62 + length x63; (Inr rvb, s''b) \<in> fst (liftE (get_cap (x61, take x62 (drop (length x63) cref'))) s''a); is_cnode_cap rvb\<rbrakk> \<Longrightarrow> is_cnode_cap rvb
 9. \<And>x61 x62 x63 rv s'' rva s''a rvb s''b. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s'); (Inr rva, s''a) \<in> fst (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) s''); \<not> length cref' \<le> x62 + length x63; (Inr rvb, s''b) \<in> fst (liftE (get_cap (x61, take x62 (drop (length x63) cref'))) s''a); \<not> is_cnode_cap rvb\<rbrakk> \<Longrightarrow> reads_spec_equiv_valid_inv s''b A aag (?P'49 x61 x62 x63 rv s'' rva s''a rvb) (returnOk ((x61, take x62 (drop (length x63) cref')), drop (x62 + length x63) cref'))
 10. \<And>x61 x62 x63 rv s'' rva s''a. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s'); (Inr rva, s''a) \<in> fst (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) s''); \<not> length cref' \<le> x62 + length x63\<rbrakk> \<Longrightarrow> reads_spec_equiv_valid_inv s''a A aag (?P'43 x61 x62 x63 rv s'' rva) (liftE (get_cap (x61, take x62 (drop (length x63) cref'))))
A total of 16 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>x61 x62 x63 s'' s''a rvb s''b. \<lbrakk>cap' = CNodeCap x61 x62 x63; 0 < x62 \<or> x63 \<noteq> []; x63 \<le> cref' \<and> (x63 \<le> cref' \<longrightarrow> s'' = s'); s''a = s'; \<not> length cref' \<le> x62 + length x63; (rvb, s''b) \<in> fst (get_cap (x61, take x62 (drop (length x63) cref')) s'); \<not> is_cnode_cap rvb\<rbrakk> \<Longrightarrow> reads_spec_equiv_valid_inv s''b A aag (?P'49 x61 x62 x63 () s' () s' rvb) (returnOk ((x61, take x62 (drop (length x63) cref')), drop (x62 + length x63) cref'))
 2. \<And>x61 x62 x63 rv s'' rva s''a. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s'); (Inr rva, s''a) \<in> fst (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) s''); \<not> length cref' \<le> x62 + length x63\<rbrakk> \<Longrightarrow> reads_spec_equiv_valid_inv s''a A aag (?P'43 x61 x62 x63 rv s'' rva) (liftE (get_cap (x61, take x62 (drop (length x63) cref'))))
 3. \<And>x61 x62 x63 rv s'' rva s''a. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s'); (Inr rva, s''a) \<in> fst (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) s''); \<not> length cref' \<le> x62 + length x63\<rbrakk> \<Longrightarrow> \<lbrace>?P''44 x61 x62 x63 rv s'' rva\<rbrace> liftE (get_cap (x61, take x62 (drop (length x63) cref'))) \<lbrace>\<lambda>rvb s. (is_cnode_cap rvb \<longrightarrow> (pas_refined aag and K (is_cnode_cap (fst (rvb, drop (x62 + length x63) cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (rvb, drop (x62 + length x63) cref'))))) s) \<and> (\<not> is_cnode_cap rvb \<longrightarrow> ?P'49 x61 x62 x63 rv s'' rva s''a rvb s)\<rbrace>, -
 4. \<And>x61 x62 x63 rv s''. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s')\<rbrakk> \<Longrightarrow> reads_spec_equiv_valid_inv s'' A aag (?P'33 x61 x62 x63 rv) (whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))))
 5. \<And>x61 x62 x63 rv s''. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = []); (Inr rv, s'') \<in> fst (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) s')\<rbrakk> \<Longrightarrow> \<lbrace>?P''34 x61 x62 x63 rv\<rbrace> whenE (length cref' < x62 + length x63) (throwError (DepthMismatch (length cref') (x62 + length x63))) \<lbrace>\<lambda>rva s. (length cref' \<le> x62 + length x63 \<longrightarrow> True) \<and> (\<not> length cref' \<le> x62 + length x63 \<longrightarrow> ?P'43 x61 x62 x63 rv s'' rva s \<and> ?P''44 x61 x62 x63 rv s'' rva s)\<rbrace>, -
 6. \<And>x61 x62 x63. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = [])\<rbrakk> \<Longrightarrow> reads_spec_equiv_valid_inv s' A aag (?P'31 x61 x62 x63) (whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)))
 7. \<And>x61 x62 x63. \<lbrakk>cap' = CNodeCap x61 x62 x63; \<not> (x62 = 0 \<and> x63 = [])\<rbrakk> \<Longrightarrow> \<lbrace>?P''31 x61 x62 x63\<rbrace> whenE (\<not> x63 \<le> cref') (throwError (GuardMismatch (length cref') x63)) \<lbrace>\<lambda>rv s. ?P'33 x61 x62 x63 rv s \<and> ?P''34 x61 x62 x63 rv s\<rbrace>, -
 8. \<And>x61 x62 x63 s. \<lbrakk>cap' = CNodeCap x61 x62 x63; (pas_refined aag and (\<lambda>y. is_subject aag x61)) s\<rbrakk> \<Longrightarrow> (x62 = 0 \<and> x63 = [] \<longrightarrow> True) \<and> (\<not> (x62 = 0 \<and> x63 = []) \<longrightarrow> ?P'31 x61 x62 x63 s \<and> ?P''31 x61 x62 x63 s) proof (prove)
goal (1 subgoal):
 1. \<And>x61 x62 x63 s. \<lbrakk>cap' = CNodeCap x61 x62 x63; (pas_refined aag and (\<lambda>y. is_subject aag x61)) s\<rbrakk> \<Longrightarrow> (x62 = 0 \<and> x63 = [] \<longrightarrow> True) \<and> (\<not> (x62 = 0 \<and> x63 = []) \<longrightarrow> (\<not> x63 \<le> cref' \<longrightarrow> True) \<and> (\<not> \<not> x63 \<le> cref' \<longrightarrow> (length cref' < x62 + length x63 \<longrightarrow> True) \<and> (\<not> length cref' < x62 + length x63 \<longrightarrow> (length cref' \<le> x62 + length x63 \<longrightarrow> True) \<and> (\<not> length cref' \<le> x62 + length x63 \<longrightarrow> K (aag_can_read aag (fst (x61, take x62 (drop (length x63) cref')))) s \<and> (\<forall>cap. cte_wp_at ((=) cap) (x61, take x62 (drop (length x63) cref')) s \<longrightarrow> (is_cnode_cap cap \<longrightarrow> (pas_refined aag and K (is_cnode_cap (fst (cap, drop (x62 + length x63) cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap, drop (x62 + length x63) cref'))))) s) \<and> (\<not> is_cnode_cap cap \<longrightarrow> True)))))) proof (prove)
goal:
No subgoals! proof (state)
this:
reads_spec_equiv_valid_inv s' A aag (pas_refined aag and K (is_cnode_cap (fst (cap', cref')) \<longrightarrow> is_subject aag (obj_ref_of (fst (cap', cref'))))) (resolve_address_bits' z (cap', cref'))

goal:
No subgoals!