theory Untyped_DR

lemma decode_untyped_corres:
  "\<lbrakk> Some (UntypedIntent ui) = transform_intent (invocation_type label') args';
     cap = transform_cap cap';
     cap' = cap.UntypedCap dev ptr sz idx;
     slot = transform_cslot_ptr slot';
     excaps = transform_cap_list excaps' \<rbrakk> \<Longrightarrow>
   dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y))
       \<top> (cte_wp_at ((=) cap') slot' and invs
           and (\<lambda>s. \<forall>x \<in> set (map fst excaps'). s \<turnstile> x)
           and (\<lambda>s. \<forall>x \<in> set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) and valid_etcbs)
     (Untyped_D.decode_untyped_invocation cap slot excaps ui)
     (Decode_A.decode_untyped_invocation label' args' slot' cap' (map fst excaps'))" supply if_cong[cong] apply (simp add: transform_intent_def map_option_Some_eq2
                   transform_intent_untyped_retype_def
            split: invocation_label.split_asm gen_invocation_labels.split_asm
                   arch_invocation_label.split_asm list.split_asm option.split_asm) apply (cases ui) apply (drule transform_translate_type[where 'a=det_ext]) apply (clarsimp simp: Untyped_D.decode_untyped_invocation_def
                        Decode_A.decode_untyped_invocation_def
                        unlessE_whenE
             split del: if_split
                 split: invocation_label.split_asm) apply (rename_tac a list w1 w2 w3 w4 w5 apiobject_type) apply (cases excaps') apply (simp add: get_index_def transform_cap_list_def
                    alternative_refl gen_invocation_type_eq) apply (simp add: get_index_def transform_cap_list_def throw_on_none_def
                   split_beta
               split del: if_split) apply (clarsimp simp: corres_whenE_throwError_split_rhs
                        corres_alternate2
             split del: if_split) apply (simp add: bindE_assoc[symmetric] split del: if_split) apply (rule_tac r'="\<lambda>rv rv'. rv = transform_cap rv'"
              in corres_alternative_throw_splitE) apply (rule corres_guard_imp, rule corres_alternate1) apply (rule corres_if) apply (simp add: unat_eq_0) apply (rule corres_trivial, simp add: returnOk_def) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres; simp) apply clarsimp apply (rule get_cap_corres) apply simp apply (wp lsfco_not_idle | simp)+ apply (clarsimp simp: cte_wp_at_caps_of_state) apply auto[1] apply (rename_tac cnode_cap cnode_cap') apply (simp add: bindE_assoc split del: if_split) apply (simp add: if_to_top_of_bindE is_cnode_cap_transform_cap[symmetric]
                  split del: if_split) apply (rule corres_if_rhs[rotated]) apply (rule corres_trivial, simp add: alternative_refl) apply (simp add: corres_whenE_throwError_split_rhs
                       corres_alternate2) apply (intro impI) apply (rule_tac r'=dc in corres_alternative_throw_splitE[rotated]) apply (simp add:liftE_bindE) apply (rule corres_symb_exec_r) apply (clarsimp simp: corres_whenE_throwError_split_rhs corres_alternate2
                         split del: if_split) apply (rule corres_alternate1) apply (simp add:gets_get split del: if_split) apply (rule corres_underlying_gets_pre_lhs) apply (rule_tac P' = "\<lambda>s. valid_mdb s \<and> cte_at slot' s \<and> is_cnode_cap cnode_cap' \<and>
                cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and>
                is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and>
                reset = (descendants_of slot' (cdt s) ={} ) \<and> valid_etcbs s"
                and P = "\<lambda>s. s = x" in corres_returnOk) apply (simp add: translate_untyped_invocation_def transform_def get_free_ref_def) apply (simp add:has_children_def KHeap_D.is_cdt_parent_def
                descendants_of_empty_lift word_neq_0_conv) apply (clarsimp simp: not_less is_cap_simps bits_of_def) apply (clarsimp simp: is_cap_simps transform_cslot_ptr_def bits_of_def
                                    cap_aligned_def nat_bl_to_bin_nat_to_cref) apply (wp check_children_wp) apply simp apply (simp add:const_on_failure_def) apply clarsimp apply wp+ apply (clarsimp simp:conj_comms) apply (wp mapME_x_inv_wp[OF hoare_pre(2)] | simp split del: if_split)+ apply (simp split del: if_split add: if_apply_def2) apply (rule corres_alternate1) apply (rule corres_guard_imp) apply (rule_tac F="cap_aligned cnode_cap' \<and> is_cnode_cap cnode_cap'" in corres_gen_asm2) apply (subgoal_tac "map (Pair (cap_object (transform_cap cnode_cap')))
             [unat w3 ..< unat w3 + unat w4]
             = map (\<lambda>x. transform_cslot_ptr (obj_ref_of (cnode_cap'),
             (nat_to_cref (bits_of cnode_cap') x)))
             [unat w3 ..< unat w3 + unat w4]") apply (simp del: map_eq_conv) apply (simp add: mapME_x_map_simp) apply (rule mapME_x_corres_inv) apply (simp add: dc_def[symmetric]) apply (rule dcorres_ensure_empty) apply (wp mapME_x_inv_wp[OF hoare_pre(2)] | simp)+ apply (clarsimp simp: is_cap_simps transform_cslot_ptr_def bits_of_def cap_aligned_def
                              nat_bl_to_bin_nat_to_cref) apply simp apply clarsimp apply (rule hoare_pre) apply (wp hoare_drop_imp | simp)+ apply fastforce apply (clarsimp simp: conj_comms is_cnode_cap_transform_cap split del: if_split) apply (rule validE_R_validE) apply (rule_tac Q' = "\<lambda>a s. invs s \<and> valid_etcbs s \<and> valid_cap a s \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s
      \<and> (Structures_A.is_cnode_cap a \<longrightarrow> not_idle_thread (obj_ref_of a) s)"
      in hoare_post_imp_R) apply (rule hoare_pre) apply (wp get_cap_wp) apply (rule_tac Q' = "\<lambda>a s. invs s \<and> valid_etcbs s \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s"
      in hoare_post_imp_R) apply wp apply (clarsimp simp: cte_wp_at_caps_of_state) apply (frule_tac p = "(x,y)" for x y in caps_of_state_valid[rotated]) apply simp apply (clarsimp simp:valid_cap_def obj_at_def valid_idle_def pred_tcb_at_def
        is_cap_simps not_idle_thread_def is_cap_table_def dest!:invs_valid_idle) apply (clarsimp simp:valid_cap_def obj_at_def valid_idle_def pred_tcb_at_def
       is_cap_simps not_idle_thread_def is_cap_table_def dest!:invs_valid_idle) apply (clarsimp simp:invs_mdb cte_wp_at_caps_of_state valid_cap_aligned) apply (frule(1) caps_of_state_valid) apply (rule ccontr) apply (clarsimp simp:valid_cap_simps cap_aligned_def) apply (rule hoare_pre,wp,simp) apply (wp hoare_drop_imp mapME_x_inv_wp2 | simp add:if_apply_def2 split del:if_split)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (UntypedIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) cap') slot' and invs and (\<lambda>s. \<forall>x\<in>set (map fst excaps'). s \<turnstile> x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) and valid_etcbs) (Untyped_D.decode_untyped_invocation cap slot excaps ui) (Decode_A.decode_untyped_invocation label' args' slot' cap' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (UntypedIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) cap') slot' and invs and (\<lambda>s. \<forall>x\<in>set (map fst excaps'). s \<turnstile> x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) and valid_etcbs) (Untyped_D.decode_untyped_invocation cap slot excaps ui) (Decode_A.decode_untyped_invocation label' args' slot' cap' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<And>x1 x21 x22 x21a x22a x21b x22b x21c x22c x21d x22d x21e x22e x2. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel UntypedRetype; x1 = UntypedRetype; args' = x21 # x21a # x21b # x21c # x21d # x21e # x22e; x22 = x21a # x21b # x21c # x21d # x21e # x22e; x22a = x21b # x21c # x21d # x21e # x22e; x22b = x21c # x21d # x21e # x22e; x22c = x21d # x21e # x22e; x22d = x21e # x22e; transform_type x21 = Some x2; UntypedRetypeIntent x2 x21a x21b x21c x21d x21e = ui\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) and valid_etcbs) (Untyped_D.decode_untyped_invocation (cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr)) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_untyped_invocation label' (x21 # x21a # x21b # x21c # x21d # x21e # x22e) slot' (cap.UntypedCap dev ptr sz idx) (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<And>x1 x21 x22 x21a x22a x21b x22b x21c x22c x21d x22d x21e x22e x2 x1a x2a x3 x4 x5 x6. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel UntypedRetype; x1 = UntypedRetype; args' = x21 # x21a # x21b # x21c # x21d # x21e # x22e; x22 = x21a # x21b # x21c # x21d # x21e # x22e; x22a = x21b # x21c # x21d # x21e # x22e; x22b = x21c # x21d # x21e # x22e; x22c = x21d # x21e # x22e; x22d = x21e # x22e; transform_type x21 = Some x2; UntypedRetypeIntent x2 x21a x21b x21c x21d x21e = ui; ui = UntypedRetypeIntent x1a x2a x3 x4 x5 x6\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) and valid_etcbs) (Untyped_D.decode_untyped_invocation (cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr)) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_untyped_invocation label' (x21 # x21a # x21b # x21c # x21d # x21e # x22e) slot' (cap.UntypedCap dev ptr sz idx) (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<And>x1 x21 x22 x21a x22a x21b x22b x21c x22c x21d x22d x21e x22e x2 x1a x2a x3 x4 x5 x6. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel UntypedRetype; x1 = UntypedRetype; args' = x21 # x21a # x21b # x21c # x21d # x21e # x22e; x22 = x21a # x21b # x21c # x21d # x21e # x22e; x22a = x21b # x21c # x21d # x21e # x22e; x22b = x21c # x21d # x21e # x22e; x22c = x21d # x21e # x22e; x22d = x21e # x22e; UntypedRetypeIntent x2 x21a x21b x21c x21d x21e = ui; ui = UntypedRetypeIntent x1a x2a x3 x4 x5 x6; \<exists>v. data_to_obj_type x21 = returnOk v \<and> x2 = translate_object_type v\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) and valid_etcbs) (Untyped_D.decode_untyped_invocation (cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr)) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_untyped_invocation label' (x21 # x21a # x21b # x21c # x21d # x21e # x22e) slot' (cap.UntypedCap dev ptr sz idx) (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x21b x21c x21d x21e x22e v. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel UntypedRetype; args' = x21 # x21a # x21b # x21c # x21d # x21e # x22e; ui = UntypedRetypeIntent (translate_object_type v) x21a x21b x21c x21d x21e; data_to_obj_type x21 = returnOk v\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) and valid_etcbs) (doE (root_cap, root_slot) <- throw_on_none (get_index (transform_cap_list excaps') 0);
target_node <- if x21c = 0 then returnOk root_cap else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op root_cap x21b (unat x21c);
liftE (KHeap_D.get_cap target_slot)
odE;
y <- whenE (cap_type target_node \<noteq> Some CNodeType) throw;
y <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object target_node)) [unat x21d..<unat x21d + unat x21e]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type v) (unat x21a) (map (Pair (cap_object target_node)) [unat x21d..<unat x21d + unat x21e]) (has_children (transform_cslot_ptr slot') s) (unat x21e))
odE \<sqinter> throw) (doE y <- whenE (gen_invocation_type label' \<noteq> UntypedRetype) (throwError IllegalOperation);
y <- whenE (excaps' = []) (throwError TruncatedMessage);
y <- whenE (unat x21a < word_bits \<longrightarrow> \<not> obj_bits_api v (unat x21a) \<le> untyped_max_bits) (throwError (RangeError 0 (word_of_nat untyped_max_bits)));
y <- whenE (v = CapTableObject \<and> unat x21a = 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (v = apiobject_type.Untyped \<and> unat x21a < untyped_min_bits) (throwError (InvalidArgument (Suc 0)));
node_cap <- if unat x21c = 0 then returnOk (map fst excaps' ! 0) else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
liftE (CSpaceAcc_A.get_cap node_slot)
odE;
y <- if Structures_A.is_cnode_cap node_cap then returnOk () else throwError (FailedLookup False (MissingCapability (unat x21c)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat x21d) (throwError (RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat x21e = 0 \<or> unat retypeFanOutLimit < unat x21e) (throwError (RangeError 1 retypeFanOutLimit));
y <- whenE (unat x21e = 0 \<or> 2 ^ bits_of node_cap - unat x21d < unat x21e) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat x21d))));
y <- mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat x21d..<unat x21d + unat x21e]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api v (unat x21a)) < unat x21e) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type v \<and> v \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api v (unat x21a))) v (unat x21a) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat x21d..<unat x21d + unat x21e]) dev)
odE) proof (prove)
goal (1 subgoal):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) and valid_etcbs) (doE (root_cap, root_slot) <- throw_on_none (get_index (transform_cap_list excaps') 0);
target_node <- if w2 = 0 then returnOk root_cap else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op root_cap w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE;
y <- whenE (cap_type target_node \<noteq> Some CNodeType) throw;
y <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE y <- whenE (gen_invocation_type label' \<noteq> UntypedRetype) (throwError IllegalOperation);
y <- whenE (excaps' = []) (throwError TruncatedMessage);
y <- whenE (unat list < word_bits \<longrightarrow> \<not> obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits) (throwError (RangeError 0 (word_of_nat untyped_max_bits)));
y <- whenE (apiobject_type = CapTableObject \<and> unat list = 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (apiobject_type = apiobject_type.Untyped \<and> unat list < untyped_min_bits) (throwError (InvalidArgument (Suc 0)));
node_cap <- if unat w2 = 0 then returnOk (map fst excaps' ! 0) else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE;
y <- if Structures_A.is_cnode_cap node_cap then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit));
y <- whenE (unat w4 = 0 \<or> 2 ^ bits_of node_cap - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat w3))));
y <- mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]) dev)
odE) proof (prove)
goal (2 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) and valid_etcbs) (doE (root_cap, root_slot) <- throw_on_none (get_index (transform_cap_list excaps') 0);
target_node <- if w2 = 0 then returnOk root_cap else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op root_cap w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE;
y <- whenE (cap_type target_node \<noteq> Some CNodeType) throw;
y <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE y <- whenE (gen_invocation_type label' \<noteq> UntypedRetype) (throwError IllegalOperation);
y <- whenE (excaps' = []) (throwError TruncatedMessage);
y <- whenE (unat list < word_bits \<longrightarrow> \<not> obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits) (throwError (RangeError 0 (word_of_nat untyped_max_bits)));
y <- whenE (apiobject_type = CapTableObject \<and> unat list = 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (apiobject_type = apiobject_type.Untyped \<and> unat list < untyped_min_bits) (throwError (InvalidArgument (Suc 0)));
node_cap <- if unat w2 = 0 then returnOk (map fst excaps' ! 0) else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE;
y <- if Structures_A.is_cnode_cap node_cap then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit));
y <- whenE (unat w4 = 0 \<or> 2 ^ bits_of node_cap - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat w3))));
y <- mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]) dev)
odE)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = aa # lista\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) and valid_etcbs) (doE (root_cap, root_slot) <- throw_on_none (get_index (transform_cap_list excaps') 0);
target_node <- if w2 = 0 then returnOk root_cap else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op root_cap w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE;
y <- whenE (cap_type target_node \<noteq> Some CNodeType) throw;
y <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE y <- whenE (gen_invocation_type label' \<noteq> UntypedRetype) (throwError IllegalOperation);
y <- whenE (excaps' = []) (throwError TruncatedMessage);
y <- whenE (unat list < word_bits \<longrightarrow> \<not> obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits) (throwError (RangeError 0 (word_of_nat untyped_max_bits)));
y <- whenE (apiobject_type = CapTableObject \<and> unat list = 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (apiobject_type = apiobject_type.Untyped \<and> unat list < untyped_min_bits) (throwError (InvalidArgument (Suc 0)));
node_cap <- if unat w2 = 0 then returnOk (map fst excaps' ! 0) else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE;
y <- if Structures_A.is_cnode_cap node_cap then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit));
y <- whenE (unat w4 = 0 \<or> 2 ^ bits_of node_cap - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat w3))));
y <- mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]) dev)
odE) proof (prove)
goal (1 subgoal):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = aa # lista\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) and valid_etcbs) (doE (root_cap, root_slot) <- throw_on_none (get_index (transform_cap_list excaps') 0);
target_node <- if w2 = 0 then returnOk root_cap else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op root_cap w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE;
y <- whenE (cap_type target_node \<noteq> Some CNodeType) throw;
y <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE y <- whenE (gen_invocation_type label' \<noteq> UntypedRetype) (throwError IllegalOperation);
y <- whenE (excaps' = []) (throwError TruncatedMessage);
y <- whenE (unat list < word_bits \<longrightarrow> \<not> obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits) (throwError (RangeError 0 (word_of_nat untyped_max_bits)));
y <- whenE (apiobject_type = CapTableObject \<and> unat list = 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (apiobject_type = apiobject_type.Untyped \<and> unat list < untyped_min_bits) (throwError (InvalidArgument (Suc 0)));
node_cap <- if unat w2 = 0 then returnOk (map fst excaps' ! 0) else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE;
y <- if Structures_A.is_cnode_cap node_cap then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit));
y <- whenE (unat w4 = 0 \<or> 2 ^ bits_of node_cap - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat w3))));
y <- mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]) dev)
odE) proof (prove)
goal (1 subgoal):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap (fst aa), transform_cslot_ptr (snd aa)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = aa # lista\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> fst aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) (fst aa)) (snd aa) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) (doE target_node <- if w2 = 0 then returnOk (transform_cap (fst aa)) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst aa)) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE;
y <- whenE (cap_type target_node \<noteq> Some CNodeType) throw;
y <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE y <- whenE (gen_invocation_type label' \<noteq> UntypedRetype) (throwError IllegalOperation);
y <- whenE (unat list < word_bits \<longrightarrow> \<not> obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits) (throwError (RangeError 0 (word_of_nat untyped_max_bits)));
y <- whenE (apiobject_type = CapTableObject \<and> unat list = 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (apiobject_type = apiobject_type.Untyped \<and> unat list < untyped_min_bits) (throwError (InvalidArgument (Suc 0)));
node_cap <- if unat w2 = 0 then returnOk (fst aa) else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst aa) (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE;
y <- if Structures_A.is_cnode_cap node_cap then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit));
y <- whenE (unat w4 = 0 \<or> 2 ^ bits_of node_cap - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat w3))));
y <- mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]) dev)
odE) proof (prove)
goal (1 subgoal):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) (doE target_node <- if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE;
y <- whenE (cap_type target_node \<noteq> Some CNodeType) throw;
y <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE node_cap <- if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE;
y <- if Structures_A.is_cnode_cap node_cap then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit));
y <- whenE (unat w4 = 0 \<or> 2 ^ bits_of node_cap - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat w3))));
y <- mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]) dev)
odE) proof (prove)
goal (1 subgoal):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (\<lambda>_. True) (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) (doE target_node <- if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE;
s <- doE y <- doE y <- whenE (cap_type target_node \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object target_node)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE node_cap <- if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE;
reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap node_cap then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of node_cap - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of node_cap - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of node_cap - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat w3..<unat w3 + unat w4]) dev)
odE) proof (prove)
goal (6 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = transform_cap rv')) (\<lambda>_. True) (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) ((if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE) \<sqinter> throw) (if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = transform_cap rv')) (?Q282 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (?Q'282 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE) (if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; True\<rbrakk> \<Longrightarrow> ?Q282 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'282 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> (w2 = 0) = (unat w2 = 0)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = transform_cap rv')) (?P288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (?P'288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (returnOk (transform_cap aa)) (returnOk aa)
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = transform_cap rv')) (?Q288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (?Q'288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE) (doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE)
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; True\<rbrakk> \<Longrightarrow> (if w2 = 0 then ?P288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista else ?Q288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (if unat w2 = 0 then ?P'288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista else ?Q'288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = transform_cap rv')) (?P288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (?P'288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (returnOk (transform_cap aa)) (returnOk aa)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = transform_cap rv')) (?Q288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (?Q'288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE) (doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE)
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; True\<rbrakk> \<Longrightarrow> (if w2 = 0 then ?P288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista else ?Q288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (if unat w2 = 0 then ?P'288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista else ?Q'288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = transform_cap rv')) (?Q288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (?Q'288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE) (doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; True\<rbrakk> \<Longrightarrow> (if w2 = 0 then \<lambda>_. True else ?Q288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (if unat w2 = 0 then \<lambda>_. True else ?Q'288 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (?P294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (?P'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) (CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2)) (CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista target_slot node_slot. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; ?r'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista target_slot node_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = transform_cap rv')) (?R294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista target_slot) (?R'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista node_slot) (liftE (KHeap_D.get_cap target_slot)) (liftE (CSpaceAcc_A.get_cap node_slot))
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2) \<lbrace>?R294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2) \<lbrace>?R'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; True\<rbrakk> \<Longrightarrow> (if w2 = 0 then \<lambda>_. True else ?P294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista and ?Q294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (if unat w2 = 0 then \<lambda>_. True else ?P'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista and ?Q'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista target_slot node_slot. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; target_slot = transform_cslot_ptr node_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = transform_cap rv')) (?R294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista target_slot) (?R'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista node_slot) (liftE (KHeap_D.get_cap target_slot)) (liftE (CSpaceAcc_A.get_cap node_slot))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2) \<lbrace>?R294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2) \<lbrace>?R'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; True\<rbrakk> \<Longrightarrow> (if w2 = 0 then \<lambda>_. True else (\<lambda>_. True) and ?Q294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (if unat w2 = 0 then \<lambda>_. True else valid_objs and valid_cap aa and valid_global_refs and valid_idle and valid_etcbs and ?Q'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista ac ba ad bb. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (ac, ba) = transform_cslot_ptr (ad, bb)\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. rv = transform_cap rv') (?R294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cslot_ptr (ad, bb))) (?R'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (ad, bb)) (KHeap_D.get_cap (transform_cslot_ptr (ad, bb))) (CSpaceAcc_A.get_cap (ad, bb))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2) \<lbrace>?R294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2) \<lbrace>?R'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; True\<rbrakk> \<Longrightarrow> (if w2 = 0 then \<lambda>_. True else (\<lambda>_. True) and ?Q294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (if unat w2 = 0 then \<lambda>_. True else valid_objs and valid_cap aa and valid_global_refs and valid_idle and valid_etcbs and ?Q'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista ac ba ad bb. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (ac, ba) = transform_cslot_ptr (ad, bb)\<rbrakk> \<Longrightarrow> transform_cslot_ptr (ad, bb) = transform_cslot_ptr (ad, bb)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; True\<rbrakk> \<Longrightarrow> (if w2 = 0 then \<lambda>_. True else (\<lambda>_. True) and ?Q294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (if unat w2 = 0 then \<lambda>_. True else valid_objs and valid_cap aa and valid_global_refs and valid_idle and valid_etcbs and ?Q'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; True\<rbrakk> \<Longrightarrow> (if w2 = 0 then \<lambda>_. True else (\<lambda>_. True) and ?Q294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (if unat w2 = 0 then \<lambda>_. True else valid_objs and valid_cap aa and valid_global_refs and valid_idle and valid_etcbs and ?Q'294 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista) s
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> invs s \<and> s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x) \<and> cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> 0 < unat w2 \<longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; caps_of_state s slot' = Some (cap.UntypedCap dev ptr sz idx); invs s; s \<turnstile> aa; \<forall>x\<in>set lista. s \<turnstile> fst x; caps_of_state s (ab, b) = Some aa; \<forall>x\<in>set lista. caps_of_state s (snd x) = Some (fst x); valid_etcbs s; 0 < unat w2\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; x = transform_cap x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x') (doE s <- doE y <- doE y <- whenE (cap_type x \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object x)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x') \<circ> nat_to_cref (bits_of x')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (doE s <- doE y <- doE y <- whenE (cap_type cnode_cap \<noteq> Some CNodeType) throw;
mapME_x CSpace_D.ensure_empty (map (Pair (cap_object cnode_cap)) [unat w3..<unat w3 + unat w4])
odE;
liftE get
odE;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object cnode_cap)) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap cnode_cap' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of cnode_cap' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of cnode_cap' - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of cnode_cap' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of cnode_cap' - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of cnode_cap') \<circ> nat_to_cref (bits_of cnode_cap')) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of cnode_cap') \<circ> nat_to_cref (bits_of cnode_cap')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (doE x <- whenE (cap_type (transform_cap cnode_cap') \<noteq> Some CNodeType) throw;
x <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE x <- if Structures_A.is_cnode_cap cnode_cap' then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
x <- whenE (2 ^ bits_of cnode_cap' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of cnode_cap' - 1)));
x <- whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit));
x <- whenE (unat w4 = 0 \<or> 2 ^ bits_of cnode_cap' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of cnode_cap' - unat w3))));
x <- mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of cnode_cap') \<circ> nat_to_cref (bits_of cnode_cap')) [unat w3..<unat w3 + unat w4]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of cnode_cap') \<circ> nat_to_cref (bits_of cnode_cap')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (doE x <- whenE (cap_type (transform_cap cnode_cap') \<noteq> Some CNodeType) throw;
x <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (if Types_D.is_cnode_cap (transform_cap cnode_cap') then doE x <- whenE (2 ^ bits_of cnode_cap' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of cnode_cap' - 1)));
x <- whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit));
x <- whenE (unat w4 = 0 \<or> 2 ^ bits_of cnode_cap' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of cnode_cap' - unat w3))));
x <- mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of cnode_cap') \<circ> nat_to_cref (bits_of cnode_cap')) [unat w3..<unat w3 + unat w4]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of cnode_cap') \<circ> nat_to_cref (bits_of cnode_cap')) [unat w3..<unat w3 + unat w4]) dev)
odE else throwError (FailedLookup False (MissingCapability (unat w2))))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>?Q281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'281 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s'\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; cap_type (transform_cap cnode_cap') \<noteq> Some CNodeType\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?P'393 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q'395 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (doE x <- whenE (cap_type (transform_cap cnode_cap') \<noteq> Some CNodeType) throw;
x <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (throwError (FailedLookup False (MissingCapability (unat w2))))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap')\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (doE x <- whenE (cap_type (transform_cap cnode_cap') \<noteq> Some CNodeType) throw;
x <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE x <- whenE (2 ^ bits_of cnode_cap' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of cnode_cap' - 1)));
x <- whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit));
x <- whenE (unat w4 = 0 \<or> 2 ^ bits_of cnode_cap' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of cnode_cap' - unat w3))));
x <- mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of cnode_cap') \<circ> nat_to_cref (bits_of cnode_cap')) [unat w3..<unat w3 + unat w4]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of cnode_cap') \<circ> nat_to_cref (bits_of cnode_cap')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> ?P'393 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> ?Q'395 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s') \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> ?Q'395 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s')\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap')\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (doE x <- whenE (cap_type (transform_cap cnode_cap') \<noteq> Some CNodeType) throw;
x <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE x <- whenE (2 ^ bits_of cnode_cap' - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of cnode_cap' - 1)));
x <- whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit));
x <- whenE (unat w4 = 0 \<or> 2 ^ bits_of cnode_cap' - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of cnode_cap' - unat w3))));
x <- mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of cnode_cap') \<circ> nat_to_cref (bits_of cnode_cap')) [unat w3..<unat w3 + unat w4]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of cnode_cap') \<circ> nat_to_cref (bits_of cnode_cap')) [unat w3..<unat w3 + unat w4]) dev)
odE)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s') \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap')\<rbrakk> \<Longrightarrow> \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3 \<longrightarrow> 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4 \<longrightarrow> \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4 \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (doE x <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE x <- mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s') \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_untyped_invocation y)) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (doE x <- mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]);
s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE x <- mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]);
reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s') \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x x'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; dc x x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_untyped_invocation b)) (?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x) (?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x') (doE s <- liftE get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
odE \<sqinter> throw) (doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x s'\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s') \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_untyped_invocation b)) (?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (do s <- get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
od \<sqinter> throw) (do reset <- const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE);
doE x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE
od)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x s'\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s') \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (13 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' reset. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_untyped_invocation b)) (?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (?Q'462 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' reset) (do s <- get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
od \<sqinter> throw) (doE x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>?Q'462 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x s'\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap' reset. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; 0 < unat w4; \<not> unat retypeFanOutLimit < unat w4; \<not> unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4; dev \<longrightarrow> is_frame_type apiobject_type \<or> apiobject_type = apiobject_type.Untyped\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_untyped_invocation b)) (?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (?Q'462 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' reset) (do s <- get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
od \<sqinter> throw) (returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>?Q'462 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x s'\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap' reset. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; 0 < unat w4; \<not> unat retypeFanOutLimit < unat w4; \<not> unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4; dev \<longrightarrow> is_frame_type apiobject_type \<or> apiobject_type = apiobject_type.Untyped\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_untyped_invocation b)) (?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (?Q'462 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' reset) (do s <- get;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
od) (returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>?Q'462 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x s'\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap' reset. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; 0 < unat w4; \<not> unat retypeFanOutLimit < unat w4; \<not> unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4; dev \<longrightarrow> is_frame_type apiobject_type \<or> apiobject_type = apiobject_type.Untyped\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_untyped_invocation b)) (?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (?Q'462 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' reset) (do s <- gets id;
returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') s) (unat w4))
od) (returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>?Q'462 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x s'\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap' reset x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; 0 < unat w4; \<not> unat retypeFanOutLimit < unat w4; \<not> unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4; dev \<longrightarrow> is_frame_type apiobject_type \<or> apiobject_type = apiobject_type.Untyped\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_untyped_invocation b)) (?P479 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap' x) (?Q'462 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' reset) (returnOk (cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') x) (unat w4))) (returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>?Q'462 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x s'\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap' s. ?P479 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap' (id s) s \<equiv>\<^sup>? \<lambda>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'. ?Q458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' () proof (prove)
goal (13 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap' reset x s s'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; 0 < unat w4; \<not> unat retypeFanOutLimit < unat w4; \<not> unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4; dev \<longrightarrow> is_frame_type apiobject_type \<or> apiobject_type = apiobject_type.Untyped; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; s = x; valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> reset = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s'\<rbrakk> \<Longrightarrow> cdl_untyped_invocation.Retype (transform_cslot_ptr slot') (translate_object_type apiobject_type) (unat list) (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) (has_children (transform_cslot_ptr slot') x) (unat w4) = translate_untyped_invocation (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>a b. valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> a = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. b = id b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x s'\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap' x s s'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; 0 < unat w4; \<not> unat retypeFanOutLimit < unat w4; \<not> unat (2 ^ sz - word_of_nat (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4; dev \<longrightarrow> is_frame_type apiobject_type \<or> apiobject_type = apiobject_type.Untyped; \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s', cdl_cdt = transform_cdt s', cdl_current_thread = transform_current_thread s', cdl_irq_node = interrupt_irq_node s', cdl_asid_table = transform_asid_table s', cdl_current_domain = cur_domain s'\<rparr> = x; s = x; valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> valid_etcbs s'\<rbrakk> \<Longrightarrow> (\<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)) \<and> has_children (transform_cslot_ptr slot') x = (CSpaceAcc_A.descendants_of slot' (cdt s') \<noteq> {})
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>a b. valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> a = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. b = id b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x s'\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap' x s s'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; 0 < unat w4; \<not> unat retypeFanOutLimit < unat w4; \<not> unat (2 ^ sz - word_of_nat (if \<forall>a b. transform_cdt s' (a, b) \<noteq> Some (transform_cslot_ptr slot') then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4; dev \<longrightarrow> is_frame_type apiobject_type \<or> apiobject_type = apiobject_type.Untyped; \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s', cdl_cdt = transform_cdt s', cdl_current_thread = transform_current_thread s', cdl_irq_node = interrupt_irq_node s', cdl_asid_table = transform_asid_table s', cdl_current_domain = cur_domain s'\<rparr> = x; s = x; valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> valid_etcbs s'\<rbrakk> \<Longrightarrow> (\<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)) \<and> (\<exists>a b. cdl_cdt x (a, b) = Some (transform_cslot_ptr slot')) = (\<exists>a b. transform_cdt s' (a, b) = Some (transform_cslot_ptr slot'))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>a b. valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> a = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. b = id b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x s'\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s' r bits g x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> unat list; unat w3 \<le> 2 ^ bits - Suc 0; unat w4 \<le> 2 ^ bits - unat w3; unat w4 \<le> unat retypeFanOutLimit; unat w4 \<le> unat (2 ^ sz - word_of_nat (if \<forall>a b. transform_cdt s' (a, b) \<noteq> Some (transform_cslot_ptr slot') then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)); dev \<longrightarrow> is_frame_type apiobject_type \<or> apiobject_type = apiobject_type.Untyped; valid_mdb s'; cte_wp_at (\<lambda>_. True) slot' s'; cap_aligned (cap.CNodeCap r bits g); invs s'; not_idle_thread r s'; is_aligned ptr sz; idx \<le> 2 ^ sz; sz < word_bits; valid_etcbs s'; unat w3 \<le> x; x < unat w3 + unat w4\<rbrakk> \<Longrightarrow> (r, x) = transform_cslot_ptr (r, nat_to_cref bits x)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>a b. valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> a = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. b = id b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x s'\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>a b. valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> a = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b\<rbrace>
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' ()) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. b = id b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'458 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x s'\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; if CSpaceAcc_A.descendants_of slot' (cdt s) = {} then valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s else valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>a. if CSpaceAcc_A.descendants_of slot' (cdt a) = {} then valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a else valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. b = id b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>a. if CSpaceAcc_A.descendants_of slot' (cdt a) = {} then valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a else valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. b = id b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE <catch> (\<lambda>x. return False) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>a. if CSpaceAcc_A.descendants_of slot' (cdt a) = {} then valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a else valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. b = id b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; 0 < unat w4; \<not> unat retypeFanOutLimit < unat w4; valid_mdb s; cte_wp_at (\<lambda>_. True) slot' s; Structures_A.is_cnode_cap cnode_cap'; cap_aligned cnode_cap'; invs s; not_idle_thread (obj_ref_of cnode_cap') s; is_aligned ptr sz; idx \<le> 2 ^ sz; sz < word_bits; valid_etcbs s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE <catch> (\<lambda>x. return False) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>a. if CSpaceAcc_A.descendants_of slot' (cdt a) = {} then valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a else valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. b = id b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap' s sa. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; 0 < unat w4; \<not> unat retypeFanOutLimit < unat w4; valid_mdb s; cte_wp_at (\<lambda>_. True) slot' s; Structures_A.is_cnode_cap cnode_cap'; cap_aligned cnode_cap'; invs s; not_idle_thread (obj_ref_of cnode_cap') s; is_aligned ptr sz; idx \<le> 2 ^ sz; sz < word_bits; valid_etcbs s; s = sa\<rbrakk> \<Longrightarrow> s = sa \<and> s = sa
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>a. if CSpaceAcc_A.descendants_of slot' (cdt a) = {} then valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a else valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. b = id b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>a. if CSpaceAcc_A.descendants_of slot' (cdt a) = {} then valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a else valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a) (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')\<rbrace> mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. b = id b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap'\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>a b. if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs b \<and> not_idle_thread (obj_ref_of cnode_cap') b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s' \<and> not_idle_thread (obj_ref_of cnode_cap') s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')\<rbrace> doE reset <- liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE));
x <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap')) (?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap c \<longrightarrow> ?P394 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type c \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>c d. (Types_D.is_cnode_cap (transform_cap c) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista c d) \<and> (cap_type (transform_cap c) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> ?Q396 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista x s') \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (if unat (2 ^ sz - word_of_nat (free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4 then (=) s else if dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped then (=) s else (\<lambda>a. True)) s \<and> (if unat (2 ^ sz >> obj_bits_api apiobject_type (unat list)) < unat w4 then (=) s else if dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped then (=) s else (\<lambda>a. True)) s
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>a. a = id a) (\<lambda>a. if CSpaceAcc_A.descendants_of slot' (cdt a) = {} then valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a else valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a) (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>a. a = id a) (\<lambda>a. if CSpaceAcc_A.descendants_of slot' (cdt a) = {} then valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a else valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a) (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4]) \<sqinter> throw) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>a. a = id a) (\<lambda>a. if CSpaceAcc_A.descendants_of slot' (cdt a) = {} then valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a else valid_mdb a \<and> cte_wp_at (\<lambda>_. True) slot' a \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs a \<and> not_idle_thread (obj_ref_of cnode_cap') a \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt a) = {}) \<and> valid_etcbs a) (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4])) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q583 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap') (?Q'583 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4])) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; s = id s\<rbrakk> \<Longrightarrow> ?Q583 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; if CSpaceAcc_A.descendants_of slot' (cdt s) = {} then valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s else valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ?Q'583 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q583 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap') (?P'587 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4])) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; s = id s\<rbrakk> \<Longrightarrow> ?Q583 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; if CSpaceAcc_A.descendants_of slot' (cdt s) = {} then valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s else valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (?P'587 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' and (\<lambda>s. cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap')) s
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4] = map (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)) [unat w3..<unat w3 + unat w4]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q583 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap') (?P'587 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap') (mapME_x CSpace_D.ensure_empty (map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4])) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'\<rbrakk> \<Longrightarrow> map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4] = map (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)) [unat w3..<unat w3 + unat w4]
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; s = id s\<rbrakk> \<Longrightarrow> ?Q583 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; if CSpaceAcc_A.descendants_of slot' (cdt s) = {} then valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s else valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (?P'587 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' and (\<lambda>s. cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap')) s
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4] = map (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)) [unat w3..<unat w3 + unat w4]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q583 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap') (?P'587 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap') (mapME_x CSpace_D.ensure_empty (map (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)) [unat w3..<unat w3 + unat w4])) (mapME_x CSpaceAcc_A.ensure_empty (map (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a)) [unat w3..<unat w3 + unat w4]))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'\<rbrakk> \<Longrightarrow> map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4] = map (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)) [unat w3..<unat w3 + unat w4]
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; s = id s\<rbrakk> \<Longrightarrow> ?Q583 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; if CSpaceAcc_A.descendants_of slot' (cdt s) = {} then valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s else valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (?P'587 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' and (\<lambda>s. cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap')) s
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q583 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap') (?P'587 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap') (mapME_x (CSpace_D.ensure_empty \<circ> (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x))) [unat w3..<unat w3 + unat w4]) (mapME_x (CSpaceAcc_A.ensure_empty \<circ> (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a))) [unat w3..<unat w3 + unat w4])
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'\<rbrakk> \<Longrightarrow> map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4] = map (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)) [unat w3..<unat w3 + unat w4]
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; s = id s\<rbrakk> \<Longrightarrow> ?Q583 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; if CSpaceAcc_A.descendants_of slot' (cdt s) = {} then valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s else valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (?P'587 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' and (\<lambda>s. cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap')) s
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>c. ?P596 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' c x) (\<lambda>c. ?P'595 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' c x) ((CSpace_D.ensure_empty \<circ> (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x))) x) ((CSpaceAcc_A.ensure_empty \<circ> (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a))) x)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x P. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> (CSpace_D.ensure_empty \<circ> (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x))) x \<lbrace>\<lambda>x. P\<rbrace>, -
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x P'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)\<rbrakk> \<Longrightarrow> \<lbrace>P'\<rbrace> (CSpaceAcc_A.ensure_empty \<circ> (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a))) x \<lbrace>\<lambda>x. P'\<rbrace>, -
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)\<rbrakk> \<Longrightarrow> [unat w3..<unat w3 + unat w4] = [unat w3..<unat w3 + unat w4]
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'\<rbrakk> \<Longrightarrow> map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4] = map (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)) [unat w3..<unat w3 + unat w4]
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; s = id s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [unat w3..<unat w3 + unat w4]. ?P596 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; if CSpaceAcc_A.descendants_of slot' (cdt s) = {} then valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s else valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>c. \<forall>y\<in>set [unat w3..<unat w3 + unat w4]. ?P'595 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' c y) and (\<lambda>s. cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap')) s
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>c. ?P596 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' c x) (\<lambda>c. ?P'595 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista (transform_cap cnode_cap') cnode_cap' c x) (CSpace_D.ensure_empty (transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x))) (CSpaceAcc_A.ensure_empty (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x))
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x P. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> (CSpace_D.ensure_empty \<circ> (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x))) x \<lbrace>\<lambda>x. P\<rbrace>, -
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x P'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)\<rbrakk> \<Longrightarrow> \<lbrace>P'\<rbrace> (CSpaceAcc_A.ensure_empty \<circ> (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a))) x \<lbrace>\<lambda>x. P'\<rbrace>, -
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)\<rbrakk> \<Longrightarrow> [unat w3..<unat w3 + unat w4] = [unat w3..<unat w3 + unat w4]
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'\<rbrakk> \<Longrightarrow> map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4] = map (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)) [unat w3..<unat w3 + unat w4]
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; s = id s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [unat w3..<unat w3 + unat w4]. ?P596 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s x
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; if CSpaceAcc_A.descendants_of slot' (cdt s) = {} then valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s else valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>c. \<forall>y\<in>set [unat w3..<unat w3 + unat w4]. ?P'595 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' c y) and (\<lambda>s. cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap')) s
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x P. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> (CSpace_D.ensure_empty \<circ> (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x))) x \<lbrace>\<lambda>x. P\<rbrace>, -
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' x P'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)\<rbrakk> \<Longrightarrow> \<lbrace>P'\<rbrace> (CSpaceAcc_A.ensure_empty \<circ> (\<lambda>a. (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') a))) x \<lbrace>\<lambda>x. P'\<rbrace>, -
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'; \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)\<rbrakk> \<Longrightarrow> [unat w3..<unat w3 + unat w4] = [unat w3..<unat w3 + unat w4]
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'\<rbrakk> \<Longrightarrow> map (Pair (cap_object (transform_cap cnode_cap'))) [unat w3..<unat w3 + unat w4] = map (\<lambda>x. transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)) [unat w3..<unat w3 + unat w4]
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; s = id s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [unat w3..<unat w3 + unat w4]. True
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; if CSpaceAcc_A.descendants_of slot' (cdt s) = {} then valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s else valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>y\<in>set [unat w3..<unat w3 + unat w4]. (valid_idle and not_idle_thread (fst (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') y)) and valid_etcbs) a) and (\<lambda>s. cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap')) s
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap'. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap'\<rbrakk> \<Longrightarrow> \<forall>x\<in>{unat w3..<unat w3 + unat w4}. (cap_object (transform_cap cnode_cap'), x) = transform_cslot_ptr (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') x)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; s = id s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [unat w3..<unat w3 + unat w4]. True
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; if CSpaceAcc_A.descendants_of slot' (cdt s) = {} then valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s else valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>y\<in>set [unat w3..<unat w3 + unat w4]. (valid_idle and not_idle_thread (fst (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') y)) and valid_etcbs) a) and (\<lambda>s. cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap')) s
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; s = id s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [unat w3..<unat w3 + unat w4]. True
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; if CSpaceAcc_A.descendants_of slot' (cdt s) = {} then valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s else valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>y\<in>set [unat w3..<unat w3 + unat w4]. (valid_idle and not_idle_thread (fst (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') y)) and valid_etcbs) a) and (\<lambda>s. cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap')) s
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista cnode_cap cnode_cap' s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; cnode_cap = transform_cap cnode_cap'; Types_D.is_cnode_cap (transform_cap cnode_cap'); \<not> 2 ^ bits_of cnode_cap' - Suc 0 < unat w3; 0 < unat w4 \<and> \<not> unat retypeFanOutLimit < unat w4; \<not> 2 ^ bits_of cnode_cap' - unat w3 < unat w4; if CSpaceAcc_A.descendants_of slot' (cdt s) = {} then valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s else valid_mdb s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> Structures_A.is_cnode_cap cnode_cap' \<and> cap_aligned cnode_cap' \<and> invs s \<and> not_idle_thread (obj_ref_of cnode_cap') s \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s) = {}) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>y\<in>set [unat w3..<unat w3 + unat w4]. (valid_idle and not_idle_thread (fst (obj_ref_of cnode_cap', nat_to_cref (bits_of cnode_cap') y)) and valid_etcbs) a) and (\<lambda>s. cap_aligned cnode_cap' \<and> Structures_A.is_cnode_cap cnode_cap')) s
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q641 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> if w2 = 0 then returnOk (transform_cap aa) else doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap aa) w1 (unat w2);
liftE (KHeap_D.get_cap target_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap a \<longrightarrow> b = id b) \<and> (cap_type a \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; True\<rbrakk> \<Longrightarrow> ?Q641 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> w2 \<noteq> 0 \<longrightarrow> ?P'657 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. (Types_D.is_cnode_cap (transform_cap a) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt b) = {} then valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b else valid_mdb b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> Structures_A.is_cnode_cap a \<and> cap_aligned a \<and> invs b \<and> not_idle_thread (obj_ref_of a) b \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt b) = {}) \<and> valid_etcbs b)) \<and> (cap_type (transform_cap a) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. Structures_A.is_cnode_cap a \<longrightarrow> cap_aligned a \<and> invs b \<and> valid_mdb b \<and> is_aligned ptr sz \<and> sz < word_bits \<and> not_idle_thread (obj_ref_of a) b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> valid_etcbs b \<and> idx \<le> 2 ^ sz\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a b. Structures_A.is_cnode_cap a \<longrightarrow> cap_aligned a \<and> invs b \<and> valid_mdb b \<and> is_aligned ptr sz \<and> sz < word_bits \<and> not_idle_thread (obj_ref_of a) b \<and> cte_wp_at (\<lambda>_. True) slot' b \<and> valid_etcbs b \<and> idx \<le> 2 ^ sz\<rbrace>, -
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a s. invs s \<and> valid_etcbs s \<and> s \<turnstile> a \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap a \<longrightarrow> not_idle_thread (obj_ref_of a) s)\<rbrace>, -
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s \<and> valid_etcbs s \<and> s \<turnstile> rv \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap rv \<longrightarrow> not_idle_thread (obj_ref_of rv) s)\<rbrakk> \<Longrightarrow> Structures_A.is_cnode_cap rv \<longrightarrow> cap_aligned rv \<and> invs s \<and> valid_mdb s \<and> is_aligned ptr sz \<and> sz < word_bits \<and> not_idle_thread (obj_ref_of rv) s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> valid_etcbs s \<and> idx \<le> 2 ^ sz
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'674 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>a s. invs s \<and> valid_etcbs s \<and> s \<turnstile> a \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap a \<longrightarrow> not_idle_thread (obj_ref_of a) s)\<rbrace>, -
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?P'674 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s \<and> valid_etcbs s \<and> s \<turnstile> rv \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap rv \<longrightarrow> not_idle_thread (obj_ref_of rv) s)\<rbrakk> \<Longrightarrow> Structures_A.is_cnode_cap rv \<longrightarrow> cap_aligned rv \<and> invs s \<and> valid_mdb s \<and> is_aligned ptr sz \<and> sz < word_bits \<and> not_idle_thread (obj_ref_of rv) s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> valid_etcbs s \<and> idx \<le> 2 ^ sz
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; unat w2 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?P'684 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2) \<lbrace>\<lambda>node_slot s. \<forall>cap. cte_wp_at ((=) cap) node_slot s \<longrightarrow> invs s \<and> valid_etcbs s \<and> s \<turnstile> cap \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap cap \<longrightarrow> not_idle_thread (obj_ref_of cap) s)\<rbrace>, -
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (unat w2 = 0 \<longrightarrow> invs s \<and> valid_etcbs s \<and> s \<turnstile> aa \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap aa \<longrightarrow> not_idle_thread (obj_ref_of aa) s)) \<and> (unat w2 \<noteq> 0 \<longrightarrow> True \<and> ?P'684 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s)
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s \<and> valid_etcbs s \<and> s \<turnstile> rv \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap rv \<longrightarrow> not_idle_thread (obj_ref_of rv) s)\<rbrakk> \<Longrightarrow> Structures_A.is_cnode_cap rv \<longrightarrow> cap_aligned rv \<and> invs s \<and> valid_mdb s \<and> is_aligned ptr sz \<and> sz < word_bits \<and> not_idle_thread (obj_ref_of rv) s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> valid_etcbs s \<and> idx \<le> 2 ^ sz
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; unat w2 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?P'684 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista\<rbrace> CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2) \<lbrace>\<lambda>a s. invs s \<and> valid_etcbs s \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s\<rbrace>, -
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; unat w2 \<noteq> 0; invs s \<and> valid_etcbs s \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) rv s \<longrightarrow> invs s \<and> valid_etcbs s \<and> s \<turnstile> cap \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap cap \<longrightarrow> not_idle_thread (obj_ref_of cap) s)
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (unat w2 = 0 \<longrightarrow> invs s \<and> valid_etcbs s \<and> s \<turnstile> aa \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap aa \<longrightarrow> not_idle_thread (obj_ref_of aa) s)) \<and> (unat w2 \<noteq> 0 \<longrightarrow> True \<and> ?P'684 a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s)
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s \<and> valid_etcbs s \<and> s \<turnstile> rv \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap rv \<longrightarrow> not_idle_thread (obj_ref_of rv) s)\<rbrakk> \<Longrightarrow> Structures_A.is_cnode_cap rv \<longrightarrow> cap_aligned rv \<and> invs s \<and> valid_mdb s \<and> is_aligned ptr sz \<and> sz < word_bits \<and> not_idle_thread (obj_ref_of rv) s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> valid_etcbs s \<and> idx \<le> 2 ^ sz
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; unat w2 \<noteq> 0; invs s \<and> valid_etcbs s \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) rv s \<longrightarrow> invs s \<and> valid_etcbs s \<and> s \<turnstile> cap \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap cap \<longrightarrow> not_idle_thread (obj_ref_of cap) s)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (unat w2 = 0 \<longrightarrow> invs s \<and> valid_etcbs s \<and> s \<turnstile> aa \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap aa \<longrightarrow> not_idle_thread (obj_ref_of aa) s)) \<and> (unat w2 \<noteq> 0 \<longrightarrow> True \<and> invs s \<and> valid_etcbs s \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s)
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s \<and> valid_etcbs s \<and> s \<turnstile> rv \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap rv \<longrightarrow> not_idle_thread (obj_ref_of rv) s)\<rbrakk> \<Longrightarrow> Structures_A.is_cnode_cap rv \<longrightarrow> cap_aligned rv \<and> invs s \<and> valid_mdb s \<and> is_aligned ptr sz \<and> sz < word_bits \<and> not_idle_thread (obj_ref_of rv) s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> valid_etcbs s \<and> idx \<le> 2 ^ sz
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista ac ba s capa. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; 0 < unat w2; invs s; valid_etcbs s; caps_of_state s slot' = Some (cap.UntypedCap dev ptr sz idx); caps_of_state s (ac, ba) = Some capa\<rbrakk> \<Longrightarrow> s \<turnstile> capa \<and> (Structures_A.is_cnode_cap capa \<longrightarrow> not_idle_thread (obj_ref_of capa) s)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (unat w2 = 0 \<longrightarrow> invs s \<and> valid_etcbs s \<and> s \<turnstile> aa \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap aa \<longrightarrow> not_idle_thread (obj_ref_of aa) s)) \<and> (unat w2 \<noteq> 0 \<longrightarrow> True \<and> invs s \<and> valid_etcbs s \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s)
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s \<and> valid_etcbs s \<and> s \<turnstile> rv \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap rv \<longrightarrow> not_idle_thread (obj_ref_of rv) s)\<rbrakk> \<Longrightarrow> Structures_A.is_cnode_cap rv \<longrightarrow> cap_aligned rv \<and> invs s \<and> valid_mdb s \<and> is_aligned ptr sz \<and> sz < word_bits \<and> not_idle_thread (obj_ref_of rv) s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> valid_etcbs s \<and> idx \<le> 2 ^ sz
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista ac ba s capa. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; 0 < unat w2; invs s; valid_etcbs s; caps_of_state s slot' = Some (cap.UntypedCap dev ptr sz idx); caps_of_state s (ac, ba) = Some capa\<rbrakk> \<Longrightarrow> invs s
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista ac ba s capa. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; 0 < unat w2; invs s; valid_etcbs s; caps_of_state s slot' = Some (cap.UntypedCap dev ptr sz idx); caps_of_state s (ac, ba) = Some capa; s \<turnstile> capa\<rbrakk> \<Longrightarrow> s \<turnstile> capa \<and> (Structures_A.is_cnode_cap capa \<longrightarrow> not_idle_thread (obj_ref_of capa) s)
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (unat w2 = 0 \<longrightarrow> invs s \<and> valid_etcbs s \<and> s \<turnstile> aa \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap aa \<longrightarrow> not_idle_thread (obj_ref_of aa) s)) \<and> (unat w2 \<noteq> 0 \<longrightarrow> True \<and> invs s \<and> valid_etcbs s \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s)
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s \<and> valid_etcbs s \<and> s \<turnstile> rv \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap rv \<longrightarrow> not_idle_thread (obj_ref_of rv) s)\<rbrakk> \<Longrightarrow> Structures_A.is_cnode_cap rv \<longrightarrow> cap_aligned rv \<and> invs s \<and> valid_mdb s \<and> is_aligned ptr sz \<and> sz < word_bits \<and> not_idle_thread (obj_ref_of rv) s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> valid_etcbs s \<and> idx \<le> 2 ^ sz
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista ac ba s capa. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; 0 < unat w2; invs s; valid_etcbs s; caps_of_state s slot' = Some (cap.UntypedCap dev ptr sz idx); caps_of_state s (ac, ba) = Some capa; s \<turnstile> capa\<rbrakk> \<Longrightarrow> s \<turnstile> capa \<and> (Structures_A.is_cnode_cap capa \<longrightarrow> not_idle_thread (obj_ref_of capa) s)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (unat w2 = 0 \<longrightarrow> invs s \<and> valid_etcbs s \<and> s \<turnstile> aa \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap aa \<longrightarrow> not_idle_thread (obj_ref_of aa) s)) \<and> (unat w2 \<noteq> 0 \<longrightarrow> True \<and> invs s \<and> valid_etcbs s \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s)
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s \<and> valid_etcbs s \<and> s \<turnstile> rv \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap rv \<longrightarrow> not_idle_thread (obj_ref_of rv) s)\<rbrakk> \<Longrightarrow> Structures_A.is_cnode_cap rv \<longrightarrow> cap_aligned rv \<and> invs s \<and> valid_mdb s \<and> is_aligned ptr sz \<and> sz < word_bits \<and> not_idle_thread (obj_ref_of rv) s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> valid_etcbs s \<and> idx \<le> 2 ^ sz
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; (cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' and invs and (\<lambda>s. s \<turnstile> aa \<and> (\<forall>x\<in>set lista. s \<turnstile> fst x)) and (\<lambda>s. cte_wp_at ((=) aa) (ab, b) s \<and> (\<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (unat w2 = 0 \<longrightarrow> invs s \<and> valid_etcbs s \<and> s \<turnstile> aa \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap aa \<longrightarrow> not_idle_thread (obj_ref_of aa) s)) \<and> (unat w2 \<noteq> 0 \<longrightarrow> True \<and> invs s \<and> valid_etcbs s \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s)
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s \<and> valid_etcbs s \<and> s \<turnstile> rv \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap rv \<longrightarrow> not_idle_thread (obj_ref_of rv) s)\<rbrakk> \<Longrightarrow> Structures_A.is_cnode_cap rv \<longrightarrow> cap_aligned rv \<and> invs s \<and> valid_mdb s \<and> is_aligned ptr sz \<and> sz < word_bits \<and> not_idle_thread (obj_ref_of rv) s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> valid_etcbs s \<and> idx \<le> 2 ^ sz
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s \<and> valid_etcbs s \<and> s \<turnstile> rv \<and> cte_wp_at ((=) (cap.UntypedCap dev ptr sz idx)) slot' s \<and> (Structures_A.is_cnode_cap rv \<longrightarrow> not_idle_thread (obj_ref_of rv) s)\<rbrakk> \<Longrightarrow> Structures_A.is_cnode_cap rv \<longrightarrow> cap_aligned rv \<and> invs s \<and> valid_mdb s \<and> is_aligned ptr sz \<and> sz < word_bits \<and> not_idle_thread (obj_ref_of rv) s \<and> cte_wp_at (\<lambda>_. True) slot' s \<and> valid_etcbs s \<and> idx \<le> 2 ^ sz
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s; valid_etcbs s; s \<turnstile> rv; caps_of_state s slot' = Some (cap.UntypedCap dev ptr sz idx); Structures_A.is_cnode_cap rv; not_idle_thread (obj_ref_of rv) s\<rbrakk> \<Longrightarrow> is_aligned ptr sz \<and> sz < word_bits \<and> idx \<le> 2 ^ sz
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s; valid_etcbs s; s \<turnstile> rv; caps_of_state s slot' = Some (cap.UntypedCap dev ptr sz idx); Structures_A.is_cnode_cap rv; not_idle_thread (obj_ref_of rv) s; s \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> is_aligned ptr sz \<and> sz < word_bits \<and> idx \<le> 2 ^ sz
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista rv s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits; invs s; valid_etcbs s; s \<turnstile> rv; caps_of_state s slot' = Some (cap.UntypedCap dev ptr sz idx); Structures_A.is_cnode_cap rv; not_idle_thread (obj_ref_of rv) s; s \<turnstile> cap.UntypedCap dev ptr sz idx; \<not> (is_aligned ptr sz \<and> sz < word_bits \<and> idx \<le> 2 ^ sz)\<rbrakk> \<Longrightarrow> False
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if unat w2 = 0 then returnOk aa else doE node_slot <- CSpace_A.lookup_slot_for_cnode_op False aa (to_bl w1) (unat w2);
liftE (CSpaceAcc_A.get_cap node_slot)
odE \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>a list w1 w2 w3 w4 w5 apiobject_type aa ab b lista s x. \<lbrakk>cap = cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ sz - 1} (free_range_of_untyped idx sz ptr); cap' = cap.UntypedCap dev ptr sz idx; slot = transform_cslot_ptr slot'; excaps = (transform_cap aa, transform_cslot_ptr (ab, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) lista; invocation_type label' = GenInvocationLabel UntypedRetype; args' = a # list # w1 # w2 # w3 # w4 # w5; ui = UntypedRetypeIntent (translate_object_type apiobject_type) list w1 w2 w3 w4; data_to_obj_type a = returnOk apiobject_type; excaps' = (aa, ab, b) # lista; gen_invocation_type label' = UntypedRetype; unat list < word_bits; obj_bits_api apiobject_type (unat list) \<le> untyped_max_bits; apiobject_type = CapTableObject \<longrightarrow> 0 < unat list; apiobject_type = apiobject_type.Untyped \<longrightarrow> \<not> unat list < untyped_min_bits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> (Types_D.is_cnode_cap (transform_cap x) \<longrightarrow> (if CSpaceAcc_A.descendants_of slot' (cdt s') = {} then valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> True = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s' else valid_mdb s' \<and> cte_wp_at (\<lambda>_. True) slot' s' \<and> Structures_A.is_cnode_cap x \<and> cap_aligned x \<and> invs s' \<and> not_idle_thread (obj_ref_of x) s' \<and> is_aligned ptr sz \<and> idx \<le> 2 ^ sz \<and> sz < word_bits \<and> False = (CSpaceAcc_A.descendants_of slot' (cdt s') = {}) \<and> valid_etcbs s')) \<and> (cap_type (transform_cap x) \<noteq> Some CNodeType \<longrightarrow> True)\<rbrace> doE reset <- doE y <- doE y <- doE y <- doE y <- doE y <- if Structures_A.is_cnode_cap x then returnOk () else throwError (FailedLookup False (MissingCapability (unat w2)));
whenE (2 ^ bits_of x - Suc 0 < unat w3) (throwError (RangeError 0 (2 ^ bits_of x - 1)))
odE;
whenE (unat w4 = 0 \<or> unat retypeFanOutLimit < unat w4) (throwError (RangeError 1 retypeFanOutLimit))
odE;
whenE (unat w4 = 0 \<or> 2 ^ bits_of x - unat w3 < unat w4) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of x - unat w3))))
odE;
mapME_x CSpaceAcc_A.ensure_empty (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4])
odE;
liftE (const_on_failure False (doE y <- CSpace_A.ensure_no_children slot';
returnOk True
odE))
odE;
y <- doE y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)) >> obj_bits_api apiobject_type (unat list)) < unat w4) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx)))));
whenE (dev \<and> \<not> is_frame_type apiobject_type \<and> apiobject_type \<noteq> apiobject_type.Untyped) (throwError (InvalidArgument (Suc 0)))
odE;
returnOk (untyped_invocation.Retype slot' reset ptr (alignUp (get_free_ref ptr (if reset then 0 else free_index_of (cap.UntypedCap dev ptr sz idx))) (obj_bits_api apiobject_type (unat list))) apiobject_type (unat list) (map (Pair (obj_ref_of x) \<circ> nat_to_cref (bits_of x)) [unat w3..<unat w3 + unat w4]) dev)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace> proof (prove)
goal:
No subgoals!