theory Retype_DP

lemma seL4_Untyped_Retype_sep:
  "\<lbrakk>cap_object root_cnode_cap = root_cnode;
   ucptr_slot = offset ucptr root_size;
   is_cnode_cap root_cnode_cap;
   ncptr_slot = offset ncptr root_size;
   unat ncptr_slot_nat = ncptr_slot;
   one_lvl_lookup root_cnode_cap 32 root_size;
   guard_equal root_cnode_cap ucptr 32;
   guard_equal root_cnode_cap croot 32\<rbrakk>
  \<Longrightarrow> \<lbrace> K (nt\<noteq> UntypedType \<and> default_object  nt (unat ts) minBound = Some obj
    \<and> free_range\<subseteq> tot_free_range) and
    \<guillemotleft>root_tcb_id \<mapsto>f (Tcb tcb)
  \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
  \<and>* (cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size))
  \<and>* (root_cnode, ucptr_slot) \<mapsto>c UntypedCap dev obj_range free_range
  \<and>* (root_cnode, ncptr_slot ) \<mapsto>c NullCap
  \<and>* (\<And>* ptr\<in>tot_free_range. ptr \<mapsto>o Untyped)
  \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap
  \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap
  \<and>* P\<guillemotright>
    and (\<lambda>s. \<not> has_children (root_cnode,ucptr_slot) (kernel_state s) \<longrightarrow> obj_range = free_range)
  \<rbrace>
  seL4_Untyped_Retype ucptr nt ts croot node_index 0 ncptr_slot_nat 1
  \<lbrace>\<lambda>r s. (\<not> r \<longrightarrow> (\<exists>oid free_range'. (\<guillemotleft>
     (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
  \<and>* root_tcb_id \<mapsto>f (Tcb tcb)
  \<and>* (root_cnode, ncptr_slot) \<mapsto>c (default_cap nt {oid} (unat ts) dev)
  \<and>* oid \<mapsto>o obj
  \<and>* (cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size))
  \<and>* (\<And>* ptr\<in>tot_free_range - {oid}. ptr \<mapsto>o Untyped)
  \<and>* (root_cnode, ucptr_slot) \<mapsto>c UntypedCap dev obj_range free_range'
  \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap
  \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap
  \<and>* P \<guillemotright> s ) \<and> free_range' \<subseteq> free_range - {oid} \<and> oid \<in> free_range)
  \<and> has_children (root_cnode,ucptr_slot) (kernel_state s))
  \<and> (r \<longrightarrow> (\<guillemotleft>
     (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
  \<and>* root_tcb_id \<mapsto>f (Tcb tcb)
  \<and>* (cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size))
  \<and>* (root_cnode,ucptr_slot) \<mapsto>c UntypedCap dev obj_range free_range
  \<and>* (root_cnode, ncptr_slot) \<mapsto>c NullCap
  \<and>* (\<And>* ptr\<in>tot_free_range. ptr \<mapsto>o Untyped)
  \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap
  \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap
  \<and>* P \<guillemotright> s )
  \<and> (\<not>has_children (root_cnode,ucptr_slot) (kernel_state s) \<longrightarrow> obj_range = free_range))  \<rbrace>" apply (simp add:seL4_Untyped_Retype_def sep_state_projection2_def) apply (rule hoare_name_pre_state) apply (rule hoare_pre) apply (rule do_kernel_op_pull_back) apply (rule call_kernel_with_intent_allow_error_helper
               [where check= False and tcb = tcb,simplified,rotated -1]) apply assumption apply fastforce apply ((wp hoare_vcg_ex_lift set_cap_wp)+)[5] apply (rule_tac P = "\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode,ucptr_slot) nt (unat ts)
               [(root_cnode, ncptr_slot)]
               has_kids 1)"
           in hoare_gen_asmEx) apply clarsimp apply (rule hoare_vcg_E_elim[where P = P and P' = P for P,simplified,rotated]) apply wp apply (rule hoare_post_imp_R[OF hoare_vcg_conj_lift_R]) apply (rule invoke_untyped_one_has_children) apply fastforce apply (rule_tac P = "P1 \<and>* P2" for P1 P2 in
            invoke_untyped_one_wp
              [where free_range = free_range
                and obj_range = obj_range
                and obj = obj
                and tot_free_range = tot_free_range]) apply fastforce apply clarsimp apply (rule conjI) apply (sep_erule refl_imp, simp) apply (rule_tac x = oid in exI) apply (rule_tac x = free_range' in exI) apply clarsimp apply (sep_schem) apply (rule hoare_pre) apply (rule invoke_untyped_exception
              [where tot_free_range = tot_free_range and free_range = free_range and obj_range = obj_range], simp) apply force apply (wp hoare_vcg_conj_lift) apply (wp hoare_strengthen_post[OF set_cap_wp]) apply (sep_select 4,assumption) apply wp[1] apply (rule_tac P =" nt \<noteq> UntypedType
        \<and> c = UntypedCap dev obj_range free_range \<and> cs = [(root_cnode_cap,(root_cnode,offset croot root_size))]"
        in hoare_gen_asmEx) apply simp apply (rule decode_untyped_invocation_rvu) apply simp apply (simp add:lookup_extra_caps_def mapME_singleton) apply (rule wp_no_exception_seq) apply wp[1] apply (rule lookup_cap_and_slot_rvu[where r = root_size
       and  cap' = "root_cnode_cap"]) apply (rule hoare_pre, wp lookup_cap_and_slot_rvu[where r = root_size
       and cap' = "UntypedCap dev obj_range free_range"])[1] apply clarsimp apply (intro conjI allI) apply (intro impI allI) apply (rule conjI) apply (intro impI allI) apply (clarsimp dest!: reset_cap_asid_simps2 reset_cap_asid_cnode_cap) apply (intro conjI,simp_all)[1] apply sep_solve apply sep_cancel+ apply (clarsimp simp: user_pointer_at_def Let_def word_bits_def) apply (rule conjI) apply (thin_tac "<P \<and>* Q \<and>* (\<lambda>s. True)> s" for P Q s) apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def) apply (sep_solve) apply (clarsimp simp: ep_related_cap_def
                     dest!: reset_cap_asid_simps2 reset_cap_asid_cnode_cap)+ apply (thin_tac "<P \<and>* Q \<and>* (\<lambda>s. True)> s" for P Q s) apply (sep_cancel) apply (clarsimp simp: user_pointer_at_def Let_def
                          word_bits_def sep_conj_assoc) apply (sep_solve) apply (clarsimp simp: user_pointer_at_def Let_def
                         word_bits_def sep_conj_assoc) apply (wp update_thread_intent_update) apply (intro conjI allI impI,simp_all) apply (clarsimp simp:ep_related_cap_def)+ apply sep_solve apply clarsimp+ apply (sep_solve) apply clarsimp apply (sep_solve) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = ncptr_slot; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32\<rbrakk> \<Longrightarrow> \<lbrace>K (nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and Separation_SD.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, ucptr_slot) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, ncptr_slot) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) and (\<lambda>s. \<not> has_children (root_cnode, ucptr_slot) (kernel_state s) \<longrightarrow> obj_range = free_range)\<rbrace> seL4_Untyped_Retype ucptr nt ts croot node_index 0 ncptr_slot_nat 1 \<lbrace>\<lambda>r s. (\<not> r \<longrightarrow> (\<exists>oid free_range'. Separation_SD.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_cnode, ncptr_slot) \<mapsto>c default_cap nt {oid} (unat ts) dev \<and>* oid \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (root_cnode, ucptr_slot) \<mapsto>c UntypedCap dev obj_range free_range' \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> free_range' \<subseteq> free_range - {oid} \<and> oid \<in> free_range) \<and> has_children (root_cnode, ucptr_slot) (kernel_state s)) \<and> (r \<longrightarrow> Separation_SD.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, ucptr_slot) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, ncptr_slot) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, ucptr_slot) (kernel_state s) \<longrightarrow> obj_range = free_range))\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> False) \<lbrace>\<lambda>r s. (\<not> r \<longrightarrow> (\<exists>oid free_range'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) dev \<and>* oid \<mapsto>o obj \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range' \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> free_range' \<subseteq> free_range - {oid} \<and> oid \<in> free_range) \<and> has_children (root_cnode, offset ucptr root_size) (kernel_state s)) \<and> (r \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range))\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> False) \<lbrace>\<lambda>r s. (\<not> r \<longrightarrow> (\<exists>oid free_range'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) dev \<and>* oid \<mapsto>o obj \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range' \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> free_range' \<subseteq> free_range - {oid} \<and> oid \<in> free_range) \<and> has_children (root_cnode, offset ucptr root_size) (kernel_state s)) \<and> (r \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Q7 s\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> False) \<lbrace>\<lambda>r s. (\<not> r \<longrightarrow> (\<exists>oid free_range'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) dev \<and>* oid \<mapsto>o obj \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range' \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> free_range' \<subseteq> free_range - {oid} \<and> oid \<in> free_range) \<and> has_children (root_cnode, offset ucptr root_size) (kernel_state s)) \<and> (r \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range))\<rbrace>
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> ?Q7 s sa proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> False \<lbrace>\<lambda>r a. (\<not> r \<longrightarrow> (\<exists>oid free_range'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) dev \<and>* oid \<mapsto>o obj \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range' \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) a \<and> free_range' \<subseteq> free_range - {oid} \<and> oid \<in> free_range) \<and> has_children (root_cnode, offset ucptr root_size) a) \<and> (r \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) a \<and> (\<not> has_children (root_cnode, offset ucptr root_size) a \<longrightarrow> obj_range = free_range))\<rbrace>
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> ?P10 s (kernel_state sa) proof (prove)
goal (14 subgoals):
 1. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; ?Pd2.16 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op16 s) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr16 s \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> = ?intent_extra16 s
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?R16 s\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r s. (\<exists>oid free_range'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) dev \<and>* oid \<mapsto>o obj \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range' \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> free_range' \<subseteq> free_range - {oid} \<and> oid \<in> free_range) \<and> has_children (root_cnode, offset ucptr root_size) s\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ra16 s\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R16 s\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Rb16 s\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra16 s\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 8. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?PIV16 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb16 s sa\<rbrace>, \<lbrace>\<lambda>r sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op16 s) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.16 s sa\<rbrace>
 9. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV16 s iv\<rbrace>
 10. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (?intent_op16 s) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op16 s) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr16 s \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> = ?intent_extra16 s
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?R16 s\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r s. (\<exists>oid free_range'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) dev \<and>* oid \<mapsto>o obj \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range' \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> free_range' \<subseteq> free_range - {oid} \<and> oid \<in> free_range) \<and> has_children (root_cnode, offset ucptr root_size) s\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ra16 s\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R16 s\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Rb16 s\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra16 s\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 7. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?PIV16 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb16 s sa\<rbrace>, \<lbrace>\<lambda>r sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op16 s) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace>
 8. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV16 s iv\<rbrace>
 9. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (?intent_op16 s) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 10. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id (?intent_extra16 s) \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?R16 s\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r s. (\<exists>oid free_range'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) dev \<and>* oid \<mapsto>o obj \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range' \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> free_range' \<subseteq> free_range - {oid} \<and> oid \<in> free_range) \<and> has_children (root_cnode, offset ucptr root_size) s\<rbrace>
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ra16 s\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R16 s\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Rb16 s\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra16 s\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 6. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?PIV16 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb16 s sa\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 7. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV16 s iv\<rbrace>
 8. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 9. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 10. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 12 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?PIV16 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> (\<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range) \<and> has_children (root_cnode, offset ucptr root_size) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV16 s iv\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; \<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1)\<rbrakk> \<Longrightarrow> \<lbrace>?P'98 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> (\<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range) \<and> has_children (root_cnode, offset ucptr root_size) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'98 s iv and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>?P'98 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> (\<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range) \<and> has_children (cap_object root_cnode_cap, offset ucptr root_size) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'98 s iv and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>?P'98 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> (\<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range) \<and> has_children (cap_object root_cnode_cap, offset ucptr root_size) s\<rbrace>, -
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>?P'98 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'98 s iv and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>?P'129 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>\<lambda>rv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> (\<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range) \<and> has_children (cap_object root_cnode_cap, offset ucptr root_size) s\<rbrace>, -
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> ?P'129 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> ?P'129 s iv a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (10 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>?P136 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>?Q134 s has_kids\<rbrace>, -
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>?R135 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>?S134 s has_kids\<rbrace>, -
 3. \<And>s has_kids rv sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; ?Q134 s has_kids rv sa \<and> ?S134 s has_kids rv sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range) \<and> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa
 4. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> ?P136 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) sa \<and> ?R135 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> ?P136 s iv a \<and> ?R135 s iv a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 6. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 7. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 8. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 10. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (10 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0) = Retype (?uref140 s has_kids) (?nt142 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) (?ts140 s has_kids) [?slot140 s has_kids] (?has_kids140 s has_kids) (Suc 0)
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>?R135 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>?S134 s has_kids\<rbrace>, -
 3. \<And>s has_kids rv sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; has_children (?uref140 s has_kids) sa \<and> ?S134 s has_kids rv sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range) \<and> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa
 4. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (?nt142 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<noteq> UntypedType) sa \<and> ?R135 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (?nt142 s iv \<noteq> UntypedType) a \<and> ?R135 s iv a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 6. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 7. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 8. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 10. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>?R135 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>?S134 s has_kids\<rbrace>, -
 2. \<And>s has_kids rv sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<and> ?S134 s has_kids rv sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range) \<and> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa
 3. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> ?R135 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 4. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> ?R135 s iv a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 5. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 9. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0) = Retype (?uref198 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) (?nt200 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) (?ts201 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) [?dest_slot199 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))] (?has_kids181 s has_kids) (Suc 0)
 2. \<And>s has_kids rv sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<and> (\<exists>oid free_range'. oid \<in> free_range \<and> free_range' \<subseteq> free_range - {oid} \<and> cdl.lift (?dest_slot199 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<mapsto>c default_cap (?nt200 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) {oid} (?ts201 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* ?uref198 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* ?P1.196 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range) \<and> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa
 3. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object (?nt202 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) (?ts201 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) minBound = Some obj \<and> ?nt200 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift (?dest_slot199 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* ?uref198 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* ?P1.196 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 4. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> (K (default_object (?nt202 s iv) (?ts201 s iv) minBound = Some obj \<and> ?nt200 s iv \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift (?dest_slot199 s iv \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* ?uref198 s iv \<mapsto>c UntypedCap (?dev197 s iv) obj_range free_range \<and>* ?P1.196 s iv \<and>* ?P2.195 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 5. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 9. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s has_kids. ?nt200 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<equiv>\<^sup>? \<lambda>s has_kids. ?nt202 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) proof (prove)
goal (8 subgoals):
 1. \<And>s has_kids rv sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<and> (\<exists>oid free_range'. oid \<in> free_range \<and> free_range' \<subseteq> free_range - {oid} \<and> cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* ?P1.196 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range) \<and> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* ?P1.196 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s iv) obj_range free_range \<and>* ?P1.196 s iv \<and>* ?P2.195 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s has_kids sa oid free_range'. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; has_children (cap_object root_cnode_cap, offset ucptr root_size) sa; oid \<in> free_range; free_range' \<subseteq> free_range - {oid}; cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* ?P1.196 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range)
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* ?P1.196 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s iv) obj_range free_range \<and>* ?P1.196 s iv \<and>* ?P2.195 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s has_kids sa oid free_range'. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; has_children (cap_object root_cnode_cap, offset ucptr root_size) sa; oid \<in> free_range; free_range' \<subseteq> free_range - {oid}; cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* ?P1.196 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 2. \<And>s has_kids sa oid free_range'. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; has_children (cap_object root_cnode_cap, offset ucptr root_size) sa; oid \<in> free_range; free_range' \<subseteq> free_range - {oid}; cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* ?P1.196 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa\<rbrakk> \<Longrightarrow> \<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range
 3. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* ?P1.196 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 4. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s iv) obj_range free_range \<and>* ?P1.196 s iv \<and>* ?P2.195 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 5. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 9. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s has_kids sa oid free_range'. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; has_children (cap_object root_cnode_cap, offset ucptr root_size) sa; oid \<in> free_range; free_range' \<subseteq> free_range - {oid}; cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa\<rbrakk> \<Longrightarrow> \<exists>x xa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {x} (unat ts) dev \<and>* x \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {x}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range xa \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> xa \<subseteq> free_range - {x} \<and> x \<in> free_range
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s iv) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.195 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s has_kids sa oid free_range'. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; has_children (cap_object root_cnode_cap, offset ucptr root_size) sa; oid \<in> free_range; free_range' \<subseteq> free_range - {oid}; cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa\<rbrakk> \<Longrightarrow> \<exists>x. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) dev \<and>* oid \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range x \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> x \<subseteq> free_range - {oid} \<and> oid \<in> free_range
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s iv) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.195 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s has_kids sa oid free_range'. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; has_children (cap_object root_cnode_cap, offset ucptr root_size) sa; oid \<in> free_range; free_range' \<subseteq> free_range - {oid}; cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) dev \<and>* oid \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range' \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> free_range' \<subseteq> free_range - {oid} \<and> oid \<in> free_range
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s iv) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.195 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s has_kids sa oid free_range'. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; has_children (cap_object root_cnode_cap, offset ucptr root_size) sa; oid \<in> free_range; free_range' \<subseteq> free_range - {oid}; cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) dev \<and>* oid \<mapsto>o obj \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range' \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.195 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev197 s iv) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.195 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> K (nt \<noteq> UntypedType) s \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P)) s\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>?P'389 s has_kids\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 2. \<And>s has_kids sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P)) sa\<rbrakk> \<Longrightarrow> ?P'389 s has_kids sa
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s has_kids sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P)) sa\<rbrakk> \<Longrightarrow> (K (default_object nt (unat ts) minBound = Some (?obj392 s has_kids) \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev392 s has_kids) obj_range free_range \<and>* ?P392 s has_kids)) sa
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps16 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> K (nt \<noteq> UntypedType) a \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 2. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps16 s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 6. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P'422 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P)\<rbrace>
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P'414 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) sa \<and> cdl_current_domain sa = minBound) \<and> ?P'422 s iv sa) \<and> ?P'414 s iv sa\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s iv rv sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R430 s iv) sa\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P'414 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) sa \<and> cdl_current_domain sa = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R430 s iv) sa) \<and> ?P'414 s iv sa\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P'414 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 2. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> K (nt \<noteq> UntypedType) sa \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) sa \<and> cdl_current_domain sa = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa) \<and> ?P'414 s iv sa\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 6. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd16 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> K (nt \<noteq> UntypedType) s \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) s \<and> cdl_current_domain s = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s) \<and> K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1)) s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd16 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; nt \<noteq> UntypedType \<and> c = UntypedCap dev obj_range free_range \<and> cs = [(root_cnode_cap, root_cnode, offset croot root_size)]\<rbrakk> \<Longrightarrow> \<lbrace>?P'439 s c ref cs\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> K (nt \<noteq> UntypedType) s \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) s \<and> cdl_current_domain s = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s) \<and> K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1)) s\<rbrace>, \<lbrace>\<lambda>r s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?P'439 s (fst r) (snd r) xa and K (nt \<noteq> UntypedType \<and> fst r = UntypedCap dev obj_range free_range \<and> xa = [(root_cnode_cap, root_cnode, offset croot root_size)])\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s ref. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range); nt \<noteq> UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P'439 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)]\<rbrace> decode_invocation (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, offset ucptr root_size) nt (unat ts) [(root_cnode, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?P'439 s (fst r) (snd r) xa and K (nt \<noteq> UntypedType \<and> fst r = UntypedCap dev obj_range free_range \<and> xa = [(root_cnode_cap, root_cnode, offset croot root_size)])\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s ref. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range); nt \<noteq> UntypedType\<rbrakk> \<Longrightarrow> nt \<noteq> UntypedType
 2. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<not> (case InvokeUntyped (Retype (snd r) nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children (snd r) s) (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst r \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<exists>has_kids. InvokeUntyped (Retype (snd r) nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children (snd r) s) (Suc 0)) = InvokeUntyped (Retype (root_cnode, offset ucptr root_size) nt (unat ts) [(root_cnode, offset ncptr root_size)] has_kids (Suc 0)))) and (\<lambda>a. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst r \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) a \<and> (\<not> has_children (root_cnode, offset ucptr root_size) a \<longrightarrow> obj_range = free_range) \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a) and K (is_cnode_cap root_cnode_cap) and K (nt \<noteq> UntypedType \<and> fst r = UntypedCap dev obj_range free_range \<and> xa = [(root_cnode_cap, root_cnode, offset croot root_size)])\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (4 subgoals):
 1. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<not> (case InvokeUntyped (Retype (snd r) nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children (snd r) s) (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst r \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<exists>has_kids. InvokeUntyped (Retype (snd r) nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children (snd r) s) (Suc 0)) = InvokeUntyped (Retype (root_cnode, offset ucptr root_size) nt (unat ts) [(root_cnode, offset ncptr root_size)] has_kids (Suc 0)))) and (\<lambda>a. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst r \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) a \<and> (\<not> has_children (root_cnode, offset ucptr root_size) a \<longrightarrow> obj_range = free_range) \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a) and K (is_cnode_cap root_cnode_cap) and K (nt \<noteq> UntypedType \<and> fst r = UntypedCap dev obj_range free_range \<and> xa = [(root_cnode_cap, root_cnode, offset croot root_size)])\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 4. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (4 subgoals):
 1. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> doE x <- lookup_cap_and_slot root_tcb_id croot;
returnOk [x]
odE \<lbrace>\<lambda>xa s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<not> has_children (snd r) s \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst r \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> snd r = (root_cnode, offset ucptr root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst r \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> fst r = UntypedCap dev obj_range free_range \<and> xa = [(root_cnode_cap, root_cnode, offset croot root_size)]\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 4. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s r ra. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)\<rbrakk> \<Longrightarrow> \<lbrace>?P'452 s r ra\<rbrace> returnOk [ra] \<lbrace>\<lambda>xa s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<not> has_children (snd r) s \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst r \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> snd r = (root_cnode, offset ucptr root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst r \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> fst r = UntypedCap dev obj_range free_range \<and> xa = [(root_cnode_cap, root_cnode, offset croot root_size)]\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id croot \<lbrace>?P'452 s r\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (4 subgoals):
 1. \<And>s r. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.16 s (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id croot \<lbrace>\<lambda>ra a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> (\<not> has_children (snd r) a \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst r \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) a \<and> snd r = (root_cnode, offset ucptr root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst r \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) a \<and> (\<not> has_children (root_cnode, offset ucptr root_size) a \<longrightarrow> obj_range = free_range) \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> fst r = UntypedCap dev obj_range free_range \<and> [ra] = [(root_cnode_cap, root_cnode, offset croot root_size)]\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ?Pd1.16 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 4. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>r sa. ((\<forall>c. reset_cap_asid c = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> (\<not> has_children (snd r) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst r \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> snd r = (root_cnode, offset ucptr root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst r \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range) \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> fst r = UntypedCap dev obj_range free_range \<and> [(c, cap_object (?cap470 s (fst r) (snd r)), offset croot root_size)] = [(root_cnode_cap, root_cnode, offset croot root_size)]) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap469 s (fst r) (snd r) \<and>* \<box> (root_size, word_bits) : ?cap468 s (fst r) (snd r) croot \<mapsto>u root_cnode_cap \<and>* ?R467 s (fst r) (snd r)) sa) \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap468 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap470 s (fst r) (snd r)
\<lambda>s r. ?cap468 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap469 s (fst r) (snd r) proof (prove)
goal (3 subgoals):
 1. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range)\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid (UntypedCap dev obj_range free_range) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> (\<not> has_children (snd (c, cap_object (?cap476 s), offset ucptr root_size)) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst (c, cap_object (?cap476 s), offset ucptr root_size) \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> snd (c, cap_object (?cap476 s), offset ucptr root_size) = (root_cnode, offset ucptr root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst (c, cap_object (?cap476 s), offset ucptr root_size) \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> (\<not> has_children (root_cnode, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range) \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> fst (c, cap_object (?cap476 s), offset ucptr root_size) = UntypedCap dev obj_range free_range \<and> [(ca, cap_object (?cap470 s (fst (c, cap_object (?cap476 s), offset ucptr root_size)) (snd (c, cap_object (?cap476 s), offset ucptr root_size))), offset croot root_size)] = [(root_cnode_cap, root_cnode, offset croot root_size)]) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap469 s (fst (c, cap_object (?cap476 s), offset ucptr root_size)) (snd (c, cap_object (?cap476 s), offset ucptr root_size)) \<and>* \<box> (root_size, word_bits) : ?cap468 s (fst (c, cap_object (?cap476 s), offset ucptr root_size)) (snd (c, cap_object (?cap476 s), offset ucptr root_size)) croot \<mapsto>u root_cnode_cap \<and>* ?R467 s (fst (c, cap_object (?cap476 s), offset ucptr root_size)) (snd (c, cap_object (?cap476 s), offset ucptr root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap476 s), offset ucptr root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap476 s \<and>* \<box> (root_size, word_bits) : ?cap476 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap470 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r)
\<lambda>s r. ?cap469 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r) proof (prove)
goal (3 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = UntypedCap dev obj_range free_range \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cnode_cap \<longrightarrow> (\<not> has_children (cap_object (?cap476 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> cap_object (?cap476 s) = cap_object root_cnode_cap \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> c = UntypedCap dev obj_range free_range \<and> ca = root_cnode_cap \<and> cap_object (?cap470 s c (cap_object (?cap476 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap469 s c (cap_object (?cap476 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap468 s c (cap_object (?cap476 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R467 s c (cap_object (?cap476 s), offset ucptr root_size)) sa \<and> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap476 s \<and>* \<box> (root_size, word_bits) : ?cap476 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap470 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r)
\<lambda>s r. ?cap469 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r) proof (prove)
goal (4 subgoals):
 1. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> reset_cap_asid c = UntypedCap dev obj_range free_range \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cnode_cap \<longrightarrow> (\<not> has_children (cap_object (?cap476 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> cap_object (?cap476 s) = cap_object root_cnode_cap \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> c = UntypedCap dev obj_range free_range \<and> ca = root_cnode_cap \<and> cap_object (?cap470 s c (cap_object (?cap476 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap469 s c (cap_object (?cap476 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap468 s c (cap_object (?cap476 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R467 s c (cap_object (?cap476 s), offset ucptr root_size)) sa \<and> \<not> ep_related_cap c
 2. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap476 s \<and>* \<box> (root_size, word_bits) : ?cap476 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 4. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap470 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r)
\<lambda>s r. ?cap469 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r) proof (prove)
goal (4 subgoals):
 1. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cnode_cap \<longrightarrow> (\<not> has_children (cap_object (?cap476 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> cap_object (?cap476 s) = cap_object root_cnode_cap \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> c = UntypedCap dev obj_range free_range \<and> ca = root_cnode_cap \<and> cap_object (?cap470 s c (cap_object (?cap476 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap469 s c (cap_object (?cap476 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap468 s c (cap_object (?cap476 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R467 s c (cap_object (?cap476 s), offset ucptr root_size)) sa \<and> \<not> ep_related_cap c
 2. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap476 s \<and>* \<box> (root_size, word_bits) : ?cap476 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 4. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap470 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r)
\<lambda>s r. ?cap469 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r) proof (prove)
goal (5 subgoals):
 1. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> \<forall>ca. reset_cap_asid ca = reset_cap_asid root_cnode_cap \<longrightarrow> (\<not> has_children (cap_object (?cap476 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> cap_object (?cap476 s) = cap_object root_cnode_cap \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> c = UntypedCap dev obj_range free_range \<and> ca = root_cnode_cap \<and> cap_object (?cap470 s c (cap_object (?cap476 s), offset ucptr root_size)) = cap_object root_cnode_cap
 2. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap469 s c (cap_object (?cap476 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap468 s c (cap_object (?cap476 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R467 s c (cap_object (?cap476 s), offset ucptr root_size)) sa \<and> \<not> ep_related_cap c
 3. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap476 s \<and>* \<box> (root_size, word_bits) : ?cap476 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap470 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r)
\<lambda>s r. ?cap469 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r) proof (prove)
goal (5 subgoals):
 1. \<And>s sa c ca. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range; reset_cap_asid ca = reset_cap_asid root_cnode_cap\<rbrakk> \<Longrightarrow> (\<not> has_children (cap_object (?cap476 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> cap_object (?cap476 s) = cap_object root_cnode_cap \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> c = UntypedCap dev obj_range free_range \<and> ca = root_cnode_cap \<and> cap_object (?cap470 s c (cap_object (?cap476 s), offset ucptr root_size)) = cap_object root_cnode_cap
 2. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap469 s c (cap_object (?cap476 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap468 s c (cap_object (?cap476 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R467 s c (cap_object (?cap476 s), offset ucptr root_size)) sa \<and> \<not> ep_related_cap c
 3. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap476 s \<and>* \<box> (root_size, word_bits) : ?cap476 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap470 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r)
\<lambda>s r. ?cap469 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r) proof (prove)
goal (5 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> (\<not> has_children (cap_object (?cap476 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa \<and> cap_object (?cap476 s) = cap_object root_cnode_cap \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object (?cap470 s (UntypedCap dev obj_range free_range) (cap_object (?cap476 s), offset ucptr root_size)) = cap_object root_cnode_cap
 2. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap469 s c (cap_object (?cap476 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap468 s c (cap_object (?cap476 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R467 s c (cap_object (?cap476 s), offset ucptr root_size)) sa \<and> \<not> ep_related_cap c
 3. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap476 s \<and>* \<box> (root_size, word_bits) : ?cap476 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap470 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r)
\<lambda>s r. ?cap469 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap468 s (fst r) (snd r) proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa
 2. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 3. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap croot \<mapsto>u root_cnode_cap \<and>* ?R467 s c (cap_object root_cnode_cap, offset ucptr root_size)) sa \<and> \<not> ep_related_cap c
 4. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 6. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 2. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap croot \<mapsto>u root_cnode_cap \<and>* ?R467 s c (cap_object root_cnode_cap, offset ucptr root_size)) sa \<and> \<not> ep_related_cap c
 3. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s sa sb. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; (root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sb\<rbrakk> \<Longrightarrow> True
 2. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap croot \<mapsto>u root_cnode_cap \<and>* ?R467 s c (cap_object root_cnode_cap, offset ucptr root_size)) sa \<and> \<not> ep_related_cap c
 3. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (4 subgoals):
 1. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap croot \<mapsto>u root_cnode_cap \<and>* ?R467 s c (cap_object root_cnode_cap, offset ucptr root_size)) sa \<and> \<not> ep_related_cap c
 2. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 4. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap croot \<mapsto>u root_cnode_cap \<and>* ?R467 s c (cap_object root_cnode_cap, offset ucptr root_size)) sa
 2. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> \<not> ep_related_cap c
 3. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap croot \<mapsto>u root_cnode_cap \<and>* ?R467 s c (cap_object root_cnode_cap, offset ucptr root_size)) sa
 2. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> \<not> ep_related_cap c
 3. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap) \<and>* ?R467 s c (cap_object root_cnode_cap, offset ucptr root_size)) sa
 2. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> \<not> ep_related_cap c
 3. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (4 subgoals):
 1. \<And>s sa c. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; reset_cap_asid c = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> \<not> ep_related_cap c
 2. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 4. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (3 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (3 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sa; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sa
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (3 subgoals):
 1. \<And>s sa sb. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sb\<rbrakk> \<Longrightarrow> (\<box> (root_size, word_bits) : root_cnode_cap ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R476 s) sb
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (3 subgoals):
 1. \<And>s sa sb. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread sa = Some root_tcb_id; default_object nt (unat ts) minBound = Some obj; cdl_current_domain sa = minBound; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) sa \<longrightarrow> obj_range = free_range; ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) sb\<rbrakk> \<Longrightarrow> (cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* ?R476 s) sb
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (root_cnode, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> \<lbrace>?P16 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) s \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) s \<longrightarrow> obj_range = free_range)\<rbrace>
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P16 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa) \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (3 subgoals):
 1. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range); s = sa; cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range); s = sa; cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa)
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range); s = sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (3 subgoals):
 1. \<And>sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread (kernel_state sa) = Some root_tcb_id; cdl_current_domain (kernel_state sa) = minBound; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range); s = sa; cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa)
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range); s = sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range); s = sa; cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range); s = sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl_current_thread (kernel_state sa) = Some root_tcb_id; cdl_current_domain (kernel_state sa) = minBound; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range); s = sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range); s = sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (1 subgoal):
 1. \<And>sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal:
No subgoals!