theory CSpace_C

lemma setUntypedCapAsFull_ccorres [corres]:
  notes if_split [split del]
  notes Collect_const [simp del]
  notes Collect_True [simp] Collect_False [simp]
  shows
  "ccorres dc xfdc
      ((cte_wp_at' (\<lambda>c. (cteCap c) = srcCap) srcSlot)
          and valid_mdb' and pspace_aligned' and valid_objs'
          and (K (isUntypedCap newCap \<longrightarrow> (minUntypedSizeBits \<le> (capBlockSize newCap))))
          and (K (isUntypedCap srcCap \<longrightarrow> (minUntypedSizeBits \<le> capBlockSize srcCap))))
      (UNIV \<inter>  {s. ccap_relation srcCap (srcCap_' s)}
            \<inter> {s. ccap_relation newCap (newCap_' s)}
            \<inter> {s. srcSlot_' s = Ptr srcSlot})
      []
      (setUntypedCapAsFull srcCap newCap srcSlot)
      (Call setUntypedCapAsFull_'proc)" apply (cinit lift: srcCap_' newCap_' srcSlot_') apply (rule ccorres_if_lhs) apply (clarsimp simp: isCap_simps) apply csymbr apply csymbr apply (simp add: if_then_0_else_1 if_then_1_else_0 cap_get_tag_isCap_unfolded_H_cap) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (simp add: cap_get_tag_isCap_unfolded_H_cap ccorres_cond_univ_iff) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply (frule cap_get_tag_to_H(9)) apply (simp add: cap_get_tag_isCap_unfolded_H_cap) apply (rotate_tac 1) apply (frule cap_get_tag_to_H(9)) apply (simp add: cap_get_tag_isCap_unfolded_H_cap) apply simp apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply (simp add: ccorres_cond_univ_iff) apply csymbr+ apply (rule ccorres_move_c_guard_cte) apply (rule ccorres_Guard) apply (rule ccorres_call) apply (rule update_freeIndex) apply simp apply simp apply simp apply clarsimp apply (csymbr) apply (csymbr) apply (simp add: cap_get_tag_isCap) apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (simp add: cap_get_tag_isCap) apply (rule ccorres_Cond_rhs) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply (rule ccorres_cases [where P="capPtr srcCap = capPtr newCap"]) apply (clarsimp simp: cap_get_tag_isCap[symmetric] cap_get_tag_UntypedCap split: if_split_asm) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply (clarsimp simp: cap_get_tag_to_H cap_get_tag_UntypedCap split: if_split_asm) apply (rule ccorres_cond_false) apply (rule ccorres_return_Skip) apply (clarsimp simp: cap_get_tag_isCap[symmetric] cap_get_tag_UntypedCap split: if_split_asm) apply (rule ccorres_cond_false) apply (rule ccorres_return_Skip) apply (rule ccorres_return_Skip) apply clarsimp apply (rule ccorres_cond_false) apply (rule ccorres_return_Skip) apply (clarsimp simp: cap_get_tag_isCap[symmetric] cap_get_tag_UntypedCap) apply (frule(1) cte_wp_at_valid_objs_valid_cap') apply (clarsimp simp: untypedBits_defs) apply (intro conjI impI allI) apply (erule cte_wp_at_weakenE') apply (clarsimp simp: cap_get_tag_isCap[symmetric] cap_get_tag_UntypedCap split: if_split_asm) apply clarsimp apply (drule valid_cap_untyped_inv,clarsimp simp:max_free_index_def) apply (rule is_aligned_weaken) apply (rule is_aligned_shiftl_self[unfolded shiftl_t2n,where p = 1,simplified]) apply assumption apply (clarsimp simp: max_free_index_def shiftL_nat valid_cap'_def capAligned_def) apply (simp add:power_minus_is_div unat_sub word_le_nat_alt t2p_shiftr_32) apply clarsimp apply (erule cte_wp_at_weakenE', simp) apply clarsimp apply (drule valid_cap_untyped_inv) apply (clarsimp simp:max_free_index_def t2p_shiftr_32 unat_sub word_le_nat_alt) apply (clarsimp simp:field_simps) apply (rule word_less_imp_diff_less) apply (subst (asm) eq_commute, fastforce simp: unat_sub word_le_nat_alt) apply (rule capBlockSize_CL_maxSize) apply (clarsimp simp: cap_get_tag_UntypedCap) apply (clarsimp simp: cap_get_tag_isCap_unfolded_H_cap) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and K (isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) (UNIV \<inter> \<lbrace>ccap_relation srcCap \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation newCap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr srcSlot\<rbrace>) [] (setUntypedCapAsFull srcCap newCap srcSlot) (Call setUntypedCapAsFull_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1063 srcSlota newCapa srcCapa) (?Q'1063 srcSlota newCapa srcCapa) [SKIP] (if isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap then updateCap srcSlot (capFreeIndex_update (\<lambda>_. maxFreeIndex (capBlockSize srcCap)) srcCap) else return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 2. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1063 srcSlota newCapa srcCapa s \<and> s' \<in> ?Q'1063 srcSlota newCapa srcCapa proof (prove)
goal (3 subgoals):
 1. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 srcSlota newCapa srcCapa) (?S1069 srcSlota newCapa srcCapa) [SKIP] (updateCap srcSlot (capFreeIndex_update (\<lambda>_. maxFreeIndex (capBlockSize srcCap)) srcCap)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> ?S1069 srcSlota newCapa srcCapa) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?S1069 (cte_Ptr srcSlot) newCapa srcCapa) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> ?S1069 srcSlota newCapa srcCapa) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigned = cap_get_tag srcCapa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'1107 (cte_Ptr srcSlot) newCapa srcCapa ret__unsigned) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (\<acute>ret__int :== (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1107 srcSlota newCapa srcCapa v}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigned = cap_get_tag srcCapa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'1253 (cte_Ptr srcSlot) newCapa srcCapa ret__unsigned) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> ?G'1253 srcSlota newCapa srcCapa v}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'1253 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap)) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> ?G'1253 srcSlota newCapa srcCapa v}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'1253 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap)) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> ?G'1253 srcSlota newCapa srcCapa v}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = cap_get_tag newCapa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'1387 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) ret__unsigned) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (\<acute>ret__int :== (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'1387 srcSlota newCapa srcCapa v va}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = cap_get_tag newCapa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'1542 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) ret__unsigned) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> ?G'1542 srcSlota newCapa srcCapa v va}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'1542 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap)) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> ?G'1542 srcSlota newCapa srcCapa v va}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'1542 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap)) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
(\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI))))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> ?G'1542 srcSlota newCapa srcCapa v va}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'1708 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) ret__unsigned) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
(\<acute>ret__int :== (if ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'1708 srcSlota newCapa srcCapa v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'1872 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) ret__unsigned unsigned_eret_2) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (\<acute>ret__int :== (if ret__unsigned = unsigned_eret_2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> ?G'1872 srcSlota newCapa srcCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2019 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) ret__unsigned unsigned_eret_2) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> ?G'2019 srcSlota newCapa srcCapa v va vb vc}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> cap_get_tag newCapa = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap
 2. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capability.UntypedCap da v0a v1a fa = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2019 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) ret__unsigned unsigned_eret_2) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 3. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 4. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> ?G'2019 srcSlota newCapa srcCapa v va vb vc}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capability.UntypedCap da v0a v1a fa = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2019 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) ret__unsigned unsigned_eret_2) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> ?G'2019 srcSlota newCapa srcCapa v va vb vc}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capability.UntypedCap da v0a v1a fa = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2019 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) ret__unsigned unsigned_eret_2) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> ?G'2019 srcSlota newCapa srcCapa v va vb vc}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capability.UntypedCap da v0a v1a fa = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap
 2. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capability.UntypedCap da v0a v1a fa = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; capability.UntypedCap d v0a v1a f = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2019 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) ret__unsigned unsigned_eret_2) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 3. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 4. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> ?G'2019 srcSlota newCapa srcCapa v va vb vc}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa d f da v0a v1a fa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap d v0a v1a f) srcCapa; srcCap = capability.UntypedCap d v0a v1a f; newCap = capability.UntypedCap da v0a v1a fa; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capability.UntypedCap da v0a v1a fa = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ccap_relation (capability.UntypedCap da v0a v1a fa) newCapa; capability.UntypedCap d v0a v1a f = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2019 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) ret__unsigned unsigned_eret_2) [SKIP] (updateCap srcSlot (capability.UntypedCap d v0a v1a (max_free_index v1a))) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> ?G'2019 srcSlota newCapa srcCapa v va vb vc}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2019 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capPtr_CL (cap_untyped_cap_lift srcCapa))) [SKIP] (updateCap srcSlot (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))))) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> ?G'2019 srcSlota newCapa srcCapa v va vb vc}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2019 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capPtr_CL (cap_untyped_cap_lift srcCapa))) [SKIP] (updateCap srcSlot (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))))) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
(\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> ?G'2019 srcSlota newCapa srcCapa v va vb vc}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2 ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2164 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capPtr_CL (cap_untyped_cap_lift srcCapa)) ret__unsigned) [SKIP] (updateCap srcSlot (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))))) (\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
(\<acute>ret__int :== (if ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> ?G'2164 srcSlota newCapa srcCapa v va vb vc vd}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift newCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2300 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capPtr_CL (cap_untyped_cap_lift srcCapa)) ret__unsigned unsigned_eret_2) [SKIP] (updateCap srcSlot (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))))) (\<acute>ret__int :== (if ret__unsigned = unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := ve\<rparr> \<in> {s. s \<in> ?G'2300 srcSlota newCapa srcCapa v va vb vc vd ve}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift newCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2429 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capPtr_CL (cap_untyped_cap_lift srcCapa)) ret__unsigned unsigned_eret_2) [SKIP] (updateCap srcSlot (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))))) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := ve\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vd = ve then 1 else 0\<rparr> \<in> ?G'2429 srcSlota newCapa srcCapa v va vb vc vd ve}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2429 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capBlockSize_CL (cap_untyped_cap_lift srcCapa)) (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) [SKIP] (updateCap srcSlot (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))))) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := ve\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vd = ve then 1 else 0\<rparr> \<in> ?G'2429 srcSlota newCapa srcCapa v va vb vc vd ve}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2540 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capBlockSize_CL (cap_untyped_cap_lift srcCapa)) (capBlockSize_CL (cap_untyped_cap_lift srcCapa)) ret__unsigned) [SKIP] (updateCap srcSlot (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (ret__unsigned - 4)))))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> ?Q1069 srcSlota newCapa srcCapa s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := ve\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vd = ve then 1 else 0\<rparr> \<in> {s. \<forall>vf v'. vf = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vf\<rparr> \<in> {s. s \<in> ?G'2540 srcSlota newCapa srcCapa v va vb vc vd ve vf}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A2606 (cte_Ptr srcSlot) newCapa srcCapa) (?C'2603 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capBlockSize_CL (cap_untyped_cap_lift srcCapa)) (capBlockSize_CL (cap_untyped_cap_lift srcCapa)) ret__unsigned) [SKIP] (updateCap srcSlot (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))))) (Guard ShiftError \<lbrace>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (ret__unsigned - 4))))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (?A2606 srcSlota newCapa srcCapa and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := ve\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vd = ve then 1 else 0\<rparr> \<in> {s. \<forall>vf v'. vf = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vf\<rparr> \<in> {s. s \<in> ?C'2603 srcSlota newCapa srcCapa v va vb vc vd ve vf \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A2606 (cte_Ptr srcSlot) newCapa srcCapa) (?C'2610 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capBlockSize_CL (cap_untyped_cap_lift srcCapa)) (capBlockSize_CL (cap_untyped_cap_lift srcCapa)) ret__unsigned) [SKIP] (updateCap srcSlot (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))))) (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (ret__unsigned - 4)))
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (?A2606 srcSlota newCapa srcCapa and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := ve\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vd = ve then 1 else 0\<rparr> \<in> {s. \<forall>vf v'. vf = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vf\<rparr> \<in> {s. s \<in> ?C'2610 srcSlota newCapa srcCapa v va vb vc vd ve vf \<inter> \<lbrace>vf - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (6 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc (?xf''2614 newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned) (?A2606 (cte_Ptr srcSlot) newCapa srcCapa) (?C'2617 (cte_Ptr srcSlot) newCapa srcCapa (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capBlockSize_CL (cap_untyped_cap_lift srcCapa)) (capBlockSize_CL (cap_untyped_cap_lift srcCapa)) ret__unsigned) [] (updateCap srcSlot (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))))) (Call cap_untyped_cap_ptr_set_capFreeIndex_'proc)
 2. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned s ta sa. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> globals sa = globals sa
 3. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned a s t. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = ?xf''2614 newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned t
 4. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned s. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> globals (v32_'_update (\<lambda>_. 2 ^ unat (ret__unsigned - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])) s)) = globals s
 5. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 6. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (?A2606 srcSlota newCapa srcCapa and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := ve\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vd = ve then 1 else 0\<rparr> \<in> {s. \<forall>vf v'. vf = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vf\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (vf - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> ?C'2617 srcSlota newCapa srcCapa v va vb vc vd ve vf} \<inter> \<lbrace>vf - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (5 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned s ta sa. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> globals sa = globals sa
 2. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned a s t. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = xfdc t
 3. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned s. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> globals (v32_'_update (\<lambda>_. 2 ^ unat (ret__unsigned - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])) s)) = globals s
 4. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 5. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned a s t. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = xfdc t
 2. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned s. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> globals (v32_'_update (\<lambda>_. 2 ^ unat (ret__unsigned - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])) s)) = globals s
 3. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 4. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa da ret__unsigneda ret__unsignedb ret__unsignedc unsigned_eret_2a ret__unsignedd unsigned_eret_2 ret__unsigned s. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ret__unsignedc = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2a = capPtr_CL (cap_untyped_cap_lift srcCapa); da = to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa)); ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; capPtr_CL (cap_untyped_cap_lift newCapa) = capPtr_CL (cap_untyped_cap_lift srcCapa) \<and> capBlockSize_CL (cap_untyped_cap_lift newCapa) = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsignedd = capBlockSize_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> globals (v32_'_update (\<lambda>_. 2 ^ unat (ret__unsigned - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])) s)) = globals s
 2. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (2 subgoals):
 1. \<And>srcSlota newCapa srcCapa. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 srcSlota newCapa srcCapa) (?T1069 srcSlota newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlota} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(srcSlota\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))))
FI
FI)))
 2. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (2 subgoals):
 1. \<And>newCapa srcCapa. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 (cte_Ptr srcSlot) newCapa srcCapa) (?T1069 (cte_Ptr srcSlot) newCapa srcCapa) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)))
 2. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> ?T1069 srcSlota newCapa srcCapa)} proof (prove)
goal (2 subgoals):
 1. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2633 (cte_Ptr srcSlot) newCapa srcCapa ret__unsigned) [SKIP] (return ()) (\<acute>ret__int :== (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI))
 2. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2633 srcSlota newCapa srcCapa v})} proof (prove)
goal (2 subgoals):
 1. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2775 (cte_Ptr srcSlot) newCapa srcCapa ret__unsigned) [SKIP] (return ()) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 2. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> ?G'2775 srcSlota newCapa srcCapa v}})} proof (prove)
goal (2 subgoals):
 1. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1069 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2775 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (IF isUntypedCap srcCap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 2. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> ?R1069 srcSlota newCapa srcCapa s)) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> ?G'2775 srcSlota newCapa srcCapa v}})} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2895 (cte_Ptr srcSlot) newCapa srcCapa) (?S2898 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 2. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> ?Q2895 srcSlota newCapa srcCapa s) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> ?S2898 srcSlota newCapa srcCapa v) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2895 (cte_Ptr srcSlot) newCapa srcCapa) (?S2898 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(newCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI))
 2. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> ?Q2895 srcSlota newCapa srcCapa s) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> ?S2898 srcSlota newCapa srcCapa v) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2895 (cte_Ptr srcSlot) newCapa srcCapa) (?G'2919 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) ret__unsigned) [SKIP] (return ()) (\<acute>ret__int :== (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 2. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> ?Q2895 srcSlota newCapa srcCapa s) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'2919 srcSlota newCapa srcCapa v va}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2895 (cte_Ptr srcSlot) newCapa srcCapa) (?G'3074 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) ret__unsigned) [SKIP] (return ()) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 2. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> ?Q2895 srcSlota newCapa srcCapa s) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> ?G'3074 srcSlota newCapa srcCapa v va}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2895 (cte_Ptr srcSlot) newCapa srcCapa) (?G'3074 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) (IF isUntypedCap newCap THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 2. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> ?Q2895 srcSlota newCapa srcCapa s) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> ?G'3074 srcSlota newCapa srcCapa v va}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3223 (cte_Ptr srcSlot) newCapa srcCapa) (?S3226 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 3. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 4. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> ?Q3223 srcSlota newCapa srcCapa s) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> ?S3226 srcSlota newCapa srcCapa v va) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3223 (cte_Ptr srcSlot) newCapa srcCapa) (?S3226 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
(\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI))))
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 3. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 4. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> ?Q3223 srcSlota newCapa srcCapa s) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> ?S3226 srcSlota newCapa srcCapa v va) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3223 (cte_Ptr srcSlot) newCapa srcCapa) (?G'3255 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned) [SKIP] (return ()) (\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
(\<acute>ret__int :== (if ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)))
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 3. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 4. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> ?Q3223 srcSlota newCapa srcCapa s) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'3255 srcSlota newCapa srcCapa v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3223 (cte_Ptr srcSlot) newCapa srcCapa) (?G'3418 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (\<acute>ret__int :== (if ret__unsigned = unsigned_eret_2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI))
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 3. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 4. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> ?Q3223 srcSlota newCapa srcCapa s) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> ?G'3418 srcSlota newCapa srcCapa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3223 (cte_Ptr srcSlot) newCapa srcCapa) (?G'3566 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 3. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 4. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> ?Q3223 srcSlota newCapa srcCapa s) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> ?G'3566 srcSlota newCapa srcCapa v va vb vc}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (5 subgoals):
 1. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capPtr srcCap = capPtr newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G3691 (cte_Ptr srcSlot) newCapa srcCapa) (?G'3694 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capPtr srcCap \<noteq> capPtr newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?H3690 (cte_Ptr srcSlot) newCapa srcCapa) (?H'3692 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 3. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 4. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 5. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> ?G3691 srcSlota newCapa srcCapa s) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> ?H3690 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> ?G'3694 srcSlota newCapa srcCapa v va vb vc} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> ?H'3692 srcSlota newCapa srcCapa v va vb vc}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (5 subgoals):
 1. \<And>newCapa srcCapa. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; capBlockSize_CL (cap_untyped_cap_lift srcCapa) \<noteq> capBlockSize_CL (cap_untyped_cap_lift newCapa); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G3691 (cte_Ptr srcSlot) newCapa srcCapa) (?G'3694 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) (capPtr_CL (cap_untyped_cap_lift newCapa)) (capPtr_CL (cap_untyped_cap_lift newCapa))) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capPtr srcCap \<noteq> capPtr newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?H3690 (cte_Ptr srcSlot) newCapa srcCapa) (?H'3692 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 3. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 4. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 5. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> ?G3691 srcSlota newCapa srcCapa s) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> ?H3690 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> ?G'3694 srcSlota newCapa srcCapa v va vb vc} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> ?H'3692 srcSlota newCapa srcCapa v va vb vc}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (5 subgoals):
 1. \<And>newCapa srcCapa. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; capBlockSize_CL (cap_untyped_cap_lift srcCapa) \<noteq> capBlockSize_CL (cap_untyped_cap_lift newCapa); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G3691 (cte_Ptr srcSlot) newCapa srcCapa) (?G'3694 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) (capPtr_CL (cap_untyped_cap_lift newCapa)) (capPtr_CL (cap_untyped_cap_lift newCapa))) [SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
(\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)))
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capPtr srcCap \<noteq> capPtr newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?H3690 (cte_Ptr srcSlot) newCapa srcCapa) (?H'3692 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 3. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 4. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 5. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> ?G3691 srcSlota newCapa srcCapa s) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> ?H3690 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> ?G'3694 srcSlota newCapa srcCapa v va vb vc} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> ?H'3692 srcSlota newCapa srcCapa v va vb vc}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (5 subgoals):
 1. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; capBlockSize_CL (cap_untyped_cap_lift srcCapa) \<noteq> capBlockSize_CL (cap_untyped_cap_lift newCapa); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G3691 (cte_Ptr srcSlot) newCapa srcCapa) (?G'3722 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) (capPtr_CL (cap_untyped_cap_lift newCapa)) (capPtr_CL (cap_untyped_cap_lift newCapa)) ret__unsigned) [SKIP] (return ()) (\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
(\<acute>ret__int :== (if ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI))
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capPtr srcCap \<noteq> capPtr newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?H3690 (cte_Ptr srcSlot) newCapa srcCapa) (?H'3692 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 3. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 4. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 5. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> ?G3691 srcSlota newCapa srcCapa s) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> ?H3690 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> ?G'3722 srcSlota newCapa srcCapa v va vb vc vd}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> ?H'3692 srcSlota newCapa srcCapa v va vb vc}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (5 subgoals):
 1. \<And>newCapa srcCapa ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; capBlockSize_CL (cap_untyped_cap_lift srcCapa) \<noteq> capBlockSize_CL (cap_untyped_cap_lift newCapa); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift newCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G3691 (cte_Ptr srcSlot) newCapa srcCapa) (?G'3850 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) (capPtr_CL (cap_untyped_cap_lift newCapa)) (capPtr_CL (cap_untyped_cap_lift newCapa)) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (\<acute>ret__int :== (if ret__unsigned = unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capPtr srcCap \<noteq> capPtr newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?H3690 (cte_Ptr srcSlot) newCapa srcCapa) (?H'3692 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 3. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 4. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 5. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> ?G3691 srcSlota newCapa srcCapa s) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> ?H3690 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := ve\<rparr> \<in> {s. s \<in> ?G'3850 srcSlota newCapa srcCapa v va vb vc vd ve}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> ?H'3692 srcSlota newCapa srcCapa v va vb vc}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (5 subgoals):
 1. \<And>newCapa srcCapa ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; capBlockSize_CL (cap_untyped_cap_lift srcCapa) \<noteq> capBlockSize_CL (cap_untyped_cap_lift newCapa); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift newCapa); unsigned_eret_2 = capBlockSize_CL (cap_untyped_cap_lift srcCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G3691 (cte_Ptr srcSlot) newCapa srcCapa) (?G'3972 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) (capPtr_CL (cap_untyped_cap_lift newCapa)) (capPtr_CL (cap_untyped_cap_lift newCapa)) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capPtr srcCap \<noteq> capPtr newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?H3690 (cte_Ptr srcSlot) newCapa srcCapa) (?H'3692 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 3. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 4. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 5. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> ?G3691 srcSlota newCapa srcCapa s) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> ?H3690 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := ve\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vd = ve then 1 else 0\<rparr> \<in> ?G'3972 srcSlota newCapa srcCapa v va vb vc vd ve}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> ?H'3692 srcSlota newCapa srcCapa v va vb vc}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (5 subgoals):
 1. \<And>newCapa srcCapa. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; capBlockSize_CL (cap_untyped_cap_lift srcCapa) \<noteq> capBlockSize_CL (cap_untyped_cap_lift newCapa); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G3691 (cte_Ptr srcSlot) newCapa srcCapa) (?G'3972 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) (capPtr_CL (cap_untyped_cap_lift newCapa)) (capPtr_CL (cap_untyped_cap_lift newCapa)) (capBlockSize_CL (cap_untyped_cap_lift newCapa)) (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) [SKIP] (return ()) (Cond {} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))) SKIP)
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capPtr srcCap \<noteq> capPtr newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?H3690 (cte_Ptr srcSlot) newCapa srcCapa) (?H'3692 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 3. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 4. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 5. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> ?G3691 srcSlota newCapa srcCapa s) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> ?H3690 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := ve\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vd = ve then 1 else 0\<rparr> \<in> ?G'3972 srcSlota newCapa srcCapa v va vb vc vd ve}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> ?H'3692 srcSlota newCapa srcCapa v va vb vc}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (5 subgoals):
 1. \<And>newCapa srcCapa. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; capBlockSize_CL (cap_untyped_cap_lift srcCapa) \<noteq> capBlockSize_CL (cap_untyped_cap_lift newCapa); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G3691 (cte_Ptr srcSlot) newCapa srcCapa) (?R'4071 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) (capPtr_CL (cap_untyped_cap_lift newCapa)) (capPtr_CL (cap_untyped_cap_lift newCapa)) (capBlockSize_CL (cap_untyped_cap_lift newCapa)) (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) [SKIP] (return ()) SKIP
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capPtr srcCap \<noteq> capPtr newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?H3690 (cte_Ptr srcSlot) newCapa srcCapa) (?H'3692 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 3. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 4. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 5. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> ?G3691 srcSlota newCapa srcCapa s) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> ?H3690 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>vd v'. vd = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := ve\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vd = ve then 1 else 0\<rparr> \<in> ?R'4071 srcSlota newCapa srcCapa v va vb vc vd ve \<inter> - {}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> ?H'3692 srcSlota newCapa srcCapa v va vb vc}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsignedb = cap_get_tag newCapa; isUntypedCap newCap; ret__unsigned = capPtr_CL (cap_untyped_cap_lift srcCapa); unsigned_eret_2 = capPtr_CL (cap_untyped_cap_lift newCapa); capPtr srcCap \<noteq> capPtr newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?H3690 (cte_Ptr srcSlot) newCapa srcCapa) (?H'3692 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) ret__unsigned unsigned_eret_2) [SKIP] (return ()) (IF (if ret__unsigned = unsigned_eret_2 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 3. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 4. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> True) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> ?H3690 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> UNIV \<inter> - {}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> ?H'3692 srcSlota newCapa srcCapa v va vb vc}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) \<noteq> capPtr_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?H3690 (cte_Ptr srcSlot) newCapa srcCapa) (?H'3692 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capPtr_CL (cap_untyped_cap_lift newCapa))) [SKIP] (return ()) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI)
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 3. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 4. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> True) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> ?H3690 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> UNIV \<inter> - {}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> ?H'3692 srcSlota newCapa srcCapa v va vb vc}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) \<noteq> capPtr_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?H3690 (cte_Ptr srcSlot) newCapa srcCapa) (?R'4081 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (capPtr_CL (cap_untyped_cap_lift newCapa))) [SKIP] (return ()) SKIP
 2. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 3. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 4. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> True) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> ?H3690 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if vb = vc then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> UNIV \<inter> - {}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> ?R'4081 srcSlota newCapa srcCapa v va vb vc \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigneda = cap_get_tag srcCapa; isUntypedCap srcCap; ret__unsigned = cap_get_tag newCapa; \<not> isUntypedCap newCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3222 (cte_Ptr srcSlot) newCapa srcCapa) (?T3224 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa) (cap_get_tag newCapa)) [SKIP] (return ()) SKIP
 2. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 3. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> True) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> True)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> ?R3222 srcSlota newCapa srcCapa s)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> UNIV \<inter> - {}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> ?T3224 srcSlota newCapa srcCapa v va)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (2 subgoals):
 1. \<And>newCapa srcCapa ret__unsigned. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; capPtr srcCap = capPtr newCap \<longrightarrow> isUntypedCap newCap \<longrightarrow> isUntypedCap srcCap \<longrightarrow> capBlockSize srcCap \<noteq> capBlockSize newCap; ret__unsigned = cap_get_tag srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 2. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> True) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> True)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> True)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> UNIV \<inter> - {}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> UNIV)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (2 subgoals):
 1. \<And>newCapa srcCapa. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?T2896 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(srcCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capPtr_'proc(newCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(newCapa);;
\<acute>unsigned_eret_2 :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>unsigned_eret_2 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(srcCapa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr srcSlot} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))))
FI
FI)
 2. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> True) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> True)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> True)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> UNIV \<inter> - {}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> UNIV)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?T2896 srcSlota newCapa srcCapa v)}}})} proof (prove)
goal (2 subgoals):
 1. \<And>newCapa srcCapa. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; \<not> isUntypedCap srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2894 (cte_Ptr srcSlot) newCapa srcCapa) (?R'4089 (cte_Ptr srcSlot) newCapa srcCapa (cap_get_tag srcCapa)) [SKIP] (return ()) SKIP
 2. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> True) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> True)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> True)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> ?R2894 srcSlota newCapa srcCapa s))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> UNIV \<inter> - {}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> UNIV)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> ?R'4089 srcSlota newCapa srcCapa v \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})} proof (prove)
goal (1 subgoal):
 1. \<And>srcSlota newCapa srcCapa s s'. \<lbrakk>srcSlota = cte_Ptr srcSlot; ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot and valid_mdb' and pspace_aligned' and valid_objs' and (\<lambda>y. isUntypedCap newCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize newCap) and (\<lambda>y. isUntypedCap srcCap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize srcCap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> (valid_objs' and cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot and (\<lambda>_. is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlota)) s) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> (isUntypedCap srcCap \<longrightarrow> (isUntypedCap newCap \<longrightarrow> (capPtr srcCap = capPtr newCap \<longrightarrow> True) \<and> (capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> True)) \<and> (\<not> isUntypedCap newCap \<longrightarrow> True)) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> True))) \<and> s' \<in> {s. (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va = v then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = vb then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. v32_'_update (\<lambda>_. 2 ^ unat (v - 4)) (cap_ptr_'_update (\<lambda>_. cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(srcSlota\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat (max_free_index (unat vb)) >> minUntypedSizeBits\<rbrace>} \<inter> \<lbrace>v - 4 < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = va}}}}}) \<and> (\<not> (isUntypedCap srcCap \<and> isUntypedCap newCap \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap) \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap srcCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap then 1 else 0\<rparr> \<in> {s. (isUntypedCap newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> {s. capPtr srcCap = capPtr newCap \<longrightarrow> s \<in> {s. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. newCapa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCapa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v = va then 1 else 0\<rparr> \<in> UNIV \<inter> - {}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}} \<inter> {s. capPtr srcCap \<noteq> capPtr newCap \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. newCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCapa) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}) \<and> (\<not> isUntypedCap newCap \<longrightarrow> s \<in> UNIV)}}}) \<and> (\<not> isUntypedCap srcCap \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})} proof (prove)
goal (1 subgoal):
 1. \<And>newCapa srcCapa s s'. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> minUntypedSizeBits \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> minUntypedSizeBits \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))\<rbrakk> \<Longrightarrow> (srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot s \<and> is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)) \<and> cte_wp_at' (\<lambda>_. True) srcSlot s) \<and> (srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> minUntypedSizeBits \<and> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20 \<and> cap_get_tag srcCapa = cap_get_tag newCapa) proof (prove)
goal (1 subgoal):
 1. \<And>newCapa srcCapa s s'. \<lbrakk>ccap_relation newCap newCapa; ccap_relation srcCap srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = srcCap) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> minUntypedSizeBits \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> minUntypedSizeBits \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); \<exists>cte. cteCap cte = srcCap \<and> valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> (srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot s \<and> is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) minUntypedSizeBits \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)) \<and> cte_wp_at' (\<lambda>_. True) srcSlot s) \<and> (srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr srcCap = capPtr newCap \<and> capBlockSize srcCap = capBlockSize newCap \<longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> minUntypedSizeBits \<and> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20 \<and> cap_get_tag srcCapa = cap_get_tag newCapa) proof (prove)
goal (1 subgoal):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte\<rbrakk> \<Longrightarrow> (cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap \<longrightarrow> cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot s \<and> is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) 4 \<and> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)) \<and> cte_wp_at' (\<lambda>_. True) srcSlot s) \<and> (cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap \<longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4 \<and> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20 \<and> cap_get_tag srcCapa = cap_get_tag newCapa) proof (prove)
goal (7 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i) srcSlot s
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) 4
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))
 4. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s
 5. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4
 6. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 7. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (7 subgoals):
 1. \<And>newCapa srcCapa s s' cte c. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap; cteCap c = cteCap cte\<rbrakk> \<Longrightarrow> \<exists>i. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) i
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) 4
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))
 4. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s
 5. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4
 6. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 7. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (6 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))))) 4
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s
 4. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4
 5. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 6. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (6 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); valid_cap' (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) s; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))))) 4
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s
 4. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4
 5. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 6. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (6 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa); minUntypedSizeBits \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); is_aligned (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4) minUntypedSizeBits; unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)) \<le> maxUntypedSizeBits; unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)) < word_bits\<rbrakk> \<Longrightarrow> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) 4
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s
 4. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4
 5. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 6. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (7 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa); minUntypedSizeBits \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); is_aligned (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4) minUntypedSizeBits; unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)) \<le> maxUntypedSizeBits; unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)) < word_bits\<rbrakk> \<Longrightarrow> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (?x4130 newCapa srcCapa s s' cte)
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa); minUntypedSizeBits \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); is_aligned (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4) minUntypedSizeBits; unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)) \<le> maxUntypedSizeBits; unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)) < word_bits\<rbrakk> \<Longrightarrow> 4 \<le> ?x4130 newCapa srcCapa s s' cte
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))
 4. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s
 5. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4
 6. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 7. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (6 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa); minUntypedSizeBits \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); is_aligned (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4) minUntypedSizeBits; unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)) \<le> maxUntypedSizeBits; unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)) < word_bits\<rbrakk> \<Longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s
 4. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4
 5. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 6. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (5 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4
 4. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 5. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 4. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) s; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 4. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (4 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); valid_cap' (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) s; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 4. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)))) >> 4
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); valid_cap' (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) s; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift newCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)))) >> 4
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa); minUntypedSizeBits \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)) \<and> is_aligned (word_of_nat (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) minUntypedSizeBits \<and> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)) \<le> maxUntypedSizeBits \<and> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)) < word_bits\<rbrakk> \<Longrightarrow> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift newCapa) - 4) = word_of_nat (max_free_index (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)))) >> 4
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (2 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift srcCapa) - 4 < 0x20
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (2 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); valid_cap' (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) s; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift newCapa) - 4 < 0x20
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (3 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); valid_cap' (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) s; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> 4 \<le> capBlockSize_CL (cap_untyped_cap_lift newCapa)
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); valid_cap' (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) s; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift newCapa) < 0x20
 3. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (2 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); valid_cap' (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) s; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift newCapa) < 0x20
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (2 subgoals):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4))) newCapa; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); valid_cap' (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4))) s; srcCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)); newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)); capPtr_CL (cap_untyped_cap_lift srcCapa) = capPtr_CL (cap_untyped_cap_lift newCapa); capBlockSize_CL (cap_untyped_cap_lift srcCapa) = capBlockSize_CL (cap_untyped_cap_lift newCapa)\<rbrakk> \<Longrightarrow> cap_get_tag newCapa = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap
 2. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal (1 subgoal):
 1. \<And>newCapa srcCapa s s' cte. \<lbrakk>ccap_relation newCap newCapa; ccap_relation (cteCap cte) srcCapa; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) srcSlot s; valid_mdb' s; pspace_aligned' s; valid_objs' s; newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift newCapa)); cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<longrightarrow> 4 \<le> unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa)); valid_cap' (cteCap cte) s; srcCap = cteCap cte; cteCap cte = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift srcCapa))) (capPtr_CL (cap_untyped_cap_lift srcCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift srcCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift srcCapa) << 4)) \<and> newCap = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift newCapa))) (capPtr_CL (cap_untyped_cap_lift newCapa)) (unat (capBlockSize_CL (cap_untyped_cap_lift newCapa))) (unat (capFreeIndex_CL (cap_untyped_cap_lift newCapa) << 4)) \<and> capPtr (cteCap cte) = capPtr newCap \<and> capBlockSize (cteCap cte) = capBlockSize newCap\<rbrakk> \<Longrightarrow> cap_get_tag srcCapa = cap_get_tag newCapa proof (prove)
goal:
No subgoals!