theory Untyped_AI

lemma invoke_untyp_invs':
 assumes create_cap_Q: "\<And>tp sz cref slot oref reset ptr us slots dev.
     ui = Invocations_A.Retype slot reset (ptr && ~~ mask sz) ptr tp us slots dev
    \<Longrightarrow> \<lbrace>invs and Q and cte_wp_at (\<lambda>c. is_untyped_cap c
            \<and> cap_range (default_cap tp oref us dev) \<subseteq> untyped_range c
            \<and> {oref .. oref + 2 ^ (obj_bits_api tp us) - 1} \<subseteq> untyped_range c) slot
            and cte_wp_at ((=) NullCap) cref
            and K (cref \<in> set slots \<and> oref \<in> set (retype_addrs ptr tp (length slots) us))
            and K (range_cover ptr sz (obj_bits_api tp us) (length slots))\<rbrace>
         create_cap tp us slot dev (cref,oref) \<lbrace>\<lambda>_. Q\<rbrace>"
 assumes init_arch_Q: "\<And>tp slot reset sz slots ptr n us refs dev.
   ui = Invocations_A.Retype slot reset (ptr && ~~ mask sz) ptr tp us slots dev
    \<Longrightarrow> \<lbrace>Q and post_retype_invs tp refs
       and cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap dev (ptr && ~~ mask sz) sz idx) slot
       and K (refs = retype_addrs ptr tp n us
         \<and> range_cover ptr sz (obj_bits_api tp us) n)\<rbrace>
     init_arch_objects tp ptr n us refs \<lbrace>\<lambda>_. Q\<rbrace>"
 assumes retype_region_Q: "\<And>ptr us tp slot reset sz slots dev.
    ui = Invocations_A.Retype slot reset (ptr && ~~ mask sz) ptr tp us slots dev
    \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> Q s
         \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap dev (ptr && ~~ mask sz) sz idx) slot s
         \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + (2 ^ sz - 1)} s
         \<and> range_cover ptr sz (obj_bits_api tp us) (length slots)
         \<and> (tp = CapTableObject \<longrightarrow> 0 < us)
         \<and> caps_overlap_reserved {ptr..ptr + of_nat ((length slots) * 2 ^ obj_bits_api tp us) - 1} s
         \<and> caps_no_overlap ptr sz s \<rbrace>
        retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>_.Q\<rbrace>"
 assumes set_cap_Q[wp]: "\<And>ptr sz idx cref dev.
        \<lbrace>\<lambda>s. Q s \<and> invs s
        \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr) cref s
        \<and> (case ui of Invocations_A.Retype slot reset ptr' ptr tp us slots dev'
            \<Rightarrow> cref = slot \<and> dev' = dev)
        \<and> idx \<le> 2^ sz\<rbrace>
     set_cap (UntypedCap dev ptr sz idx) cref
   \<lbrace>\<lambda>rv. Q\<rbrace>"
 assumes reset_Q: "\<lbrace>Q'\<rbrace> reset_untyped_cap (case ui of Retype src_slot _ _ _ _ _ _ _ \<Rightarrow> src_slot) \<lbrace>\<lambda>_. Q\<rbrace>"
 shows
  "\<lbrace>(invs ::'state_ext state \<Rightarrow> bool)
        and (\<lambda>s. (case ui of Retype _ reset _ _ _ _ _ _ \<Rightarrow> reset) \<longrightarrow> Q' s)
        and Q and valid_untyped_inv ui and ct_active\<rbrace>
    invoke_untyped ui \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace>" apply (cases ui) apply (rule hoare_name_pre_stateE) apply (clarsimp simp only: valid_untyped_inv_wcap untyped_invocation.simps) proof - fix cref oref reset ptr_base ptr tp us slots s sz idx dev assume ui: "ui = Retype (cref, oref) reset ptr_base ptr tp us slots dev" assume Q: "Q s" and Q': "reset \<longrightarrow> Q' s" assume invs: "invs s" "ct_active s" assume vui: "valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev)
        (Some (UntypedCap dev (ptr && ~~ mask sz) sz idx)) s"
      (is "valid_untyped_inv_wcap _ (Some ?orig_cap) s") have cte_at: "cte_wp_at ((=) ?orig_cap) (cref,oref) s"
       (is "?cte_cond s") using vui by (clarsimp simp add:cte_wp_at_caps_of_state) note blah[simp del] = untyped_range.simps usable_untyped_range.simps
          atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff
          Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex note neg_mask_add_mask = word_plus_and_or_coroll2[symmetric,where w = "mask sz" and t = ptr,symmetric] have p_neq_0:"ptr \<noteq> 0" using cte_at invs apply (clarsimp simp:cte_wp_at_caps_of_state) apply (drule(1) caps_of_state_valid)+ apply (simp add:valid_cap_def) done have cover: "range_cover ptr sz (obj_bits_api tp us) (length slots)" using vui by (clarsimp simp:cte_wp_at_caps_of_state) note neg_mask_add_mask = word_plus_and_or_coroll2[symmetric,where w = "mask sz" and t = ptr,symmetric] note set_cap_free_index_invs_spec = set_free_index_invs[where
      cap = "UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)",
      unfolded free_index_update_def free_index_of_def,simplified] have slot_not_in: "(cref, oref) \<notin> set slots" using vui cte_at by (auto simp: cte_wp_at_caps_of_state) note reset_Q' = reset_Q[simplified ui, simplified] have ptr_base: "ptr_base = ptr && ~~ mask sz" using vui by (clarsimp simp: cte_wp_at_caps_of_state) note ui' = ui[unfolded ptr_base] note msimp[simp] = neg_mask_add_mask let ?ui = "Retype (cref, oref) reset ptr_base ptr tp us slots dev" show "\<lbrace>(=) s\<rbrace> invoke_untyped ?ui \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace>" using cover apply (simp add:mapM_x_def[symmetric] invoke_untyped_def) apply (rule_tac B="\<lambda>_ s. invs s \<and> Q s \<and> ct_active s
          \<and> valid_untyped_inv_wcap ?ui
            (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s
          \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)
          " in hoare_vcg_seqE[rotated]) apply (simp only: whenE_def) apply (rule hoare_pre, wp) apply (rule hoare_post_impErr, rule combine_validE,
             rule reset_untyped_cap_invs_etc, rule valid_validE, rule reset_Q') apply (clarsimp simp only: pred_conj_def if_True, blast) apply (wp | simp)+ apply (cut_tac vui Q Q' invs) apply (clarsimp simp: cte_wp_at_caps_of_state slot_not_in) apply blast apply (simp add: cte_wp_at_conj ball_conj_distrib
                       split del: if_split
              | wp hoare_vcg_const_Ball_lift set_tuple_pick
                   retype_region_ex_cte_cap_to [where sz = sz]
                   retype_region_obj_ref_range [where sz = sz]
                   hoare_vcg_all_lift
                     [of _ _ "%a _ p. \<forall>b. ~ cte_wp_at P (a,b) p" for P]
                   hoare_vcg_all_lift
                     [of _ _ "%b _ p. ~ cte_wp_at P (a,b) p" for P a]
                   retype_region_not_cte_wp_at [where sz = sz]
                   init_arch_objects_invs_from_restricted
                   retype_ret_valid_caps [where sz = sz]
                   retype_region_global_refs_disjoint [where sz = sz]
                   retype_region_post_retype_invs [where sz = sz]
                   retype_region_cte_at_other[where sz = sz]
                   retype_region_invs_extras[where sz = sz]
                   retype_region_ranges [where sz = sz]
                   retype_region_ranges_obj_bits_api[where sz=sz]
                   retype_region_caps_reserved [where sz = sz]
                   retype_region_distinct_sets [where sz = sz]
                   create_caps_invs[where ptr=ptr and slots=slots and us=us]
                   create_cap_Q[OF ui']
                   init_arch_Q[OF ui']
                   retype_region_Q[OF ui']
                   retype_region_descendants_range_ret[where sz = sz]
                   retype_region_obj_at_other2
                     [where P="is_cap_table n" for n]
                   distinct_tuple_helper
                   init_arch_objects_wps
                   init_arch_objects_nonempty_table
              | wp (once) retype_region_ret_folded_general)+ apply ((wp hoare_vcg_const_imp_lift hoare_drop_imp
                   retype_region_invs_extras[where sz = sz]
                   retype_region_aligned_for_init[where sz = sz]
                   set_free_index_invs_UntypedCap
                   set_cap_caps_no_overlap set_cap_no_overlap
                   set_untyped_cap_caps_overlap_reserved
            | strengthen tup_in_fst_image_set_zipD[mk_strg D]
                         distinct_map_fst_zip
            | simp add: ptr_base
            | wp (once) retype_region_ret_folded_general)+)[1] apply (clarsimp simp:conj_comms,simp cong:conj_cong) apply (simp add:ball_conj_distrib conj_comms) apply (strengthen invs_mdb invs_valid_pspace
                caps_region_kernel_window_imp[where p="(cref, oref)"]
                invs_cap_refs_in_kernel_window
                exI[where x="(cref, oref)"]
              | clarsimp simp: conj_comms
              | simp cong: conj_cong)+ apply (rule_tac P = "bits_of cap = sz"
                    in hoare_gen_asm) apply (simp add:bits_of_def) apply (wp set_cap_no_overlap hoare_vcg_ball_lift
                 set_free_index_invs_UntypedCap
                 set_cap_cte_wp_at set_cap_descendants_range_in
                 set_cap_caps_no_overlap
                 set_untyped_cap_caps_overlap_reserved[where
                   idx="if reset then 0 else idx"]
                 set_cap_cte_cap_wp_to
                 hoare_vcg_ex_lift
               | wp (once) hoare_drop_imps)+ apply (wp set_cap_cte_wp_at_neg hoare_vcg_all_lift get_cap_wp)+ apply (clarsimp simp: slot_not_in field_simps ui free_index_of_def
                   split del: if_split) apply ((strengthen cover refl)+)? apply (simp only: cte_wp_at_caps_of_state, clarify,
        simp only: option.simps, simp(no_asm_use) split del: if_split, clarify) apply (clarsimp simp: bits_of_def untyped_range.simps
                            if_split[where P="\<lambda>v. v \<le> unat x" for x]) apply (frule(1) valid_global_refsD2[OF _ invs_valid_global_refs]) apply (clarsimp simp:cte_wp_at_caps_of_state untyped_range.simps
                           conj_comms
                 split del: if_split) apply (frule invoke_untyped_proofs.intro[where cref="(cref, oref)" and reset=reset, rotated 1],
        simp_all add: cte_wp_at_caps_of_state split del: if_split) apply (rule conjI, (rule refl | assumption))+ apply clarsimp apply (simp add: invoke_untyped_proofs.simps p_neq_0) apply (simp add: arg_cong[OF mask_out_sub_mask, where f="\<lambda>y. x - y" for x]
                       field_simps invoke_untyped_proofs.idx_le_new_offs
                       invoke_untyped_proofs.idx_compare'
                       exI invoke_untyped_proofs.simps
                       word_bw_assocs) apply (frule cte_wp_at_pspace_no_overlapI,
        simp add: cte_wp_at_caps_of_state, simp+,
        simp add: invoke_untyped_proofs.szw) apply (cut_tac s=s in obj_is_device_vui_eq[where ui=ui]) apply (clarsimp simp: ui cte_wp_at_caps_of_state) apply (simp_all add: field_simps ui) apply (intro conjI) 

            (* slots not in retype_addrs *)
             apply (clarsimp dest!:retype_addrs_subset_ptr_bits) apply (drule(1) invoke_untyped_proofs.slots_invD) apply (drule(1) subsetD) apply (simp add:p_assoc_help) 

           (* not global refs*)
            apply (simp add: Int_commute, erule disjoint_subset2[rotated]) apply (simp add: atLeastatMost_subset_iff word_and_le2) 

          (* idx less_eq new offs *)
           apply (auto dest: invoke_untyped_proofs.idx_le_new_offs)[1] 

          (* not empty tables *)
           apply clarsimp apply (drule(1) pspace_no_overlap_obj_not_in_range, clarsimp+)[1] 

         (* set ineqs *)
          apply (simp add: atLeastatMost_subset_iff word_and_le2) apply (erule order_trans[OF invoke_untyped_proofs.subset_stuff]) apply (simp add: atLeastatMost_subset_iff word_and_le2) 

       (* new untyped range disjoint *)
        apply (drule invoke_untyped_proofs.usable_range_disjoint) apply (clarsimp simp: field_simps mask_out_sub_mask shiftl_t2n) 

      (* something about caps *)
       apply clarsimp apply (frule untyped_mdb_descendants_range, clarsimp+,
        erule invoke_untyped_proofs.descendants_range, simp_all+)[1] apply (simp add: untyped_range_def atLeastatMost_subset_iff word_and_le2) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and (\<lambda>s. (case ui of Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s) and Q and valid_untyped_inv ui and ct_active\<rbrace> invoke_untyped ui \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x3 x4 x5 x6 x7 x8. ui = Retype x1 x2 x3 x4 x5 x6 x7 x8 \<Longrightarrow> \<lbrace>invs and (\<lambda>s. (case ui of Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s) and Q and valid_untyped_inv ui and ct_active\<rbrace> invoke_untyped ui \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x3 x4 x5 x6 x7 x8 s. \<lbrakk>ui = Retype x1 x2 x3 x4 x5 x6 x7 x8; (invs and (\<lambda>s. (case ui of Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s) and Q and valid_untyped_inv ui and ct_active) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped ui \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
this:
ui = Retype (cref, oref) reset ptr_base ptr tp us slots dev

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
this:
Q s
reset \<longrightarrow> Q' s

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
this:
invs s
ct_active s

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
this:
valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz idx)) (cref, oref) s proof (prove)
using this:
valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz idx)) (cref, oref) s proof (state)
this:
cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz idx)) (cref, oref) s

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
this:
untyped_range (UntypedCap ?dev ?p ?n ?f) = {?p..?p + (1 << ?n) - 1}
untyped_range NullCap = {}
untyped_range (EndpointCap ?r ?badge ?rights) = {}
untyped_range (NotificationCap ?r ?badge ?rights) = {}
untyped_range (CNodeCap ?r ?bits ?guard) = {}
untyped_range (ThreadCap ?r) = {}
untyped_range DomainCap = {}
untyped_range (ReplyCap ?r ?master ?rights) = {}
untyped_range IRQControlCap = {}
untyped_range (IRQHandlerCap ?irq) = {}
untyped_range (Zombie ?r ?b ?n) = {}
untyped_range (ArchObjectCap ?cap) = {}
usable_untyped_range (UntypedCap ?uu ?p ?n ?f) = (if ?f < 2 ^ ?n then {?p + word_of_nat ?f..?p + 2 ^ ?n - 1} else {})
(?i \<in> {?l..?u}) = (?l \<le> ?i \<and> ?i \<le> ?u)
({?a..?b} \<subseteq> {?c..?d}) = (\<not> ?a \<le> ?b \<or> ?c \<le> ?a \<and> ?b \<le> ?d)
(?i \<in> {?l..<?u}) = (?l \<le> ?i \<and> ?i < ?u)
{?a..?b} \<inter> {?c..?d} = {max ?a ?c..min ?b ?d}
({?a..?b} = {}) = (\<not> ?a \<le> ?b)
(\<exists>x. ?P x) = (\<exists>a b. ?P (a, b))

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
this:
(ptr && mask sz) + (ptr && ~~ mask sz) = ptr

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. ptr \<noteq> 0 proof (prove)
using this:
cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz idx)) (cref, oref) s
invs s
ct_active s

goal (1 subgoal):
 1. ptr \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<lbrakk>caps_of_state s (cref, oref) = Some (UntypedCap dev 0 sz idx); invs s; ct_active s; ptr = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>caps_of_state s (cref, oref) = Some (UntypedCap dev 0 sz idx); ct_active s; ptr = 0; s \<turnstile> UntypedCap dev 0 sz idx\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
ptr \<noteq> 0

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. range_cover ptr sz (obj_bits_api tp us) (length slots) proof (prove)
using this:
valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. range_cover ptr sz (obj_bits_api tp us) (length slots) proof (state)
this:
range_cover ptr sz (obj_bits_api tp us) (length slots)

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
this:
(ptr && mask sz) + (ptr && ~~ mask sz) = ptr

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
this:
\<lbrace>\<lambda>s. (if reset then 0 else idx) \<le> ?idx \<and> ?idx \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at (\<lambda>cp. \<exists>idx'\<le>?idx. cp = UntypedCap dev (ptr && ~~ mask sz) sz idx') ?cref s\<rbrace> set_cap (UntypedCap dev (ptr && ~~ mask sz) sz ?idx) ?cref \<lbrace>\<lambda>rv. invs\<rbrace>

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. (cref, oref) \<notin> set slots proof (prove)
using this:
valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz idx)) s
cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz idx)) (cref, oref) s

goal (1 subgoal):
 1. (cref, oref) \<notin> set slots proof (state)
this:
(cref, oref) \<notin> set slots

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
this:
\<lbrace>Q'\<rbrace> reset_untyped_cap (cref, oref) \<lbrace>\<lambda>_. Q\<rbrace>

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. ptr_base = ptr && ~~ mask sz proof (prove)
using this:
valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. ptr_base = ptr && ~~ mask sz proof (state)
this:
ptr_base = ptr && ~~ mask sz

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
this:
ui = Retype (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots dev

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
this:
(ptr && mask sz) + (ptr && ~~ mask sz) = ptr

goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (state)
goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s sz idx. \<lbrakk>ui = Retype (a, b) x2 x3 x4 x5 x6 x7 x8; ct_active s; Q s; invs s; x2 \<longrightarrow> Q' s; valid_untyped_inv_wcap (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) (Some (UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (a, b) x2 x3 x4 x5 x6 x7 x8) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (cref, oref) reset ptr_base ptr tp us slots dev) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
using this:
range_cover ptr sz (obj_bits_api tp us) (length slots)

goal (1 subgoal):
 1. \<lbrace>(=) s\<rbrace> invoke_untyped (Retype (cref, oref) reset ptr_base ptr tp us slots dev) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>(=) s\<rbrace> doE y <- whenE reset (reset_untyped_cap (cref, oref));
liftE (do cap <- get_cap (cref, oref);
y <- set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref);
orefs <- retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
mapM_x (create_cap tp us (cref, oref) dev) (zip slots orefs)
od)
odE \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>(=) s\<rbrace> whenE reset (reset_untyped_cap (cref, oref)) \<lbrace>\<lambda>_ s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace>
 2. \<And>x. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace> liftE (do cap <- get_cap (cref, oref);
y <- set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref);
orefs <- retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
mapM_x (create_cap tp us (cref, oref) dev) (zip slots orefs)
od) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>(=) s\<rbrace> if reset then reset_untyped_cap (cref, oref) else returnOk () \<lbrace>\<lambda>_ s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace>
 2. \<And>x. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace> liftE (do cap <- get_cap (cref, oref);
y <- set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref);
orefs <- retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
mapM_x (create_cap tp us (cref, oref) dev) (zip slots orefs)
od) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); reset\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> reset_untyped_cap (cref, oref) \<lbrace>\<lambda>_ s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace>
 2. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset\<rbrakk> \<Longrightarrow> \<lbrace>?R7\<rbrace> returnOk () \<lbrace>\<lambda>_ s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); s = sa\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> ?Q7 sa) \<and> (\<not> reset \<longrightarrow> ?R7 sa)
 4. \<And>x. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace> liftE (do cap <- get_cap (cref, oref);
y <- set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref);
orefs <- retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
mapM_x (create_cap tp us (cref, oref) dev) (zip slots orefs)
od) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); reset; (invs and valid_untyped_inv_wcap ?ui16 (Some (UntypedCap ?dev16 ?ptr16 ?sz16 0)) and ct_active and pspace_no_overlap {?ptr16..?ptr16 + 2 ^ ?sz16 - 1} and Q) s\<rbrakk> \<Longrightarrow> invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)
 2. \<And>e s. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); reset; (invs and Q) s\<rbrakk> \<Longrightarrow> invs s \<and> Q s
 3. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset\<rbrakk> \<Longrightarrow> \<lbrace>?R7\<rbrace> returnOk () \<lbrace>\<lambda>_ s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); s = sa\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> (invs and valid_untyped_inv_wcap ?ui16 (Some (UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ?ui16 = Retype (cref, oref) True ptr_base ptr' ty us slots ?dev16) and Q') sa) \<and> (\<not> reset \<longrightarrow> ?R7 sa)
 5. \<And>x. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace> liftE (do cap <- get_cap (cref, oref);
y <- set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref);
orefs <- retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
mapM_x (create_cap tp us (cref, oref) dev) (zip slots orefs)
od) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>e s. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); reset; (invs and Q) s\<rbrakk> \<Longrightarrow> invs s \<and> Q s
 2. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset\<rbrakk> \<Longrightarrow> \<lbrace>?R7\<rbrace> returnOk () \<lbrace>\<lambda>_ s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); s = sa\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> (invs and valid_untyped_inv_wcap (Retype (cref, oref) True ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz ?idx16)) and ct_active and K (\<exists>ptr_basea ptr' ty usa slotsa. Retype (cref, oref) True ptr_base ptr tp us slots dev = Retype (cref, oref) True ptr_basea ptr' ty usa slotsa dev) and Q') sa) \<and> (\<not> reset \<longrightarrow> ?R7 sa)
 4. \<And>x. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace> liftE (do cap <- get_cap (cref, oref);
y <- set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref);
orefs <- retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
mapM_x (create_cap tp us (cref, oref) dev) (zip slots orefs)
od) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); s = sa\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> invs sa \<and> (\<exists>sza idx. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idx \<and> UntypedCap dev (ptr && ~~ mask sz) sz ?idx16 = c) (cref, oref) sa \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> (idx \<le> unat (ptr - ptr_base) \<or> ptr = ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> descendants_of (cref, oref) (cdt sa) = {} \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot sa \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)) \<and> ct_active sa \<and> Q' sa) \<and> (\<not> reset \<longrightarrow> invs sa \<and> Q sa \<and> ct_active sa \<and> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr && ~~ mask sz) sz idx = c) (cref, oref) sa \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> idxa \<le> unat (ptr - ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot sa \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)))
 2. \<And>x. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace> liftE (do cap <- get_cap (cref, oref);
y <- set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref);
orefs <- retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
mapM_x (create_cap tp us (cref, oref) dev) (zip slots orefs)
od) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); s = sa; valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz idx)) s; Q s; reset \<longrightarrow> Q' s; invs s; ct_active s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> invs sa \<and> (\<exists>sza idx. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idx \<and> UntypedCap dev (ptr && ~~ mask sz) sz ?idx16 = c) (cref, oref) sa \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> (idx \<le> unat (ptr - ptr_base) \<or> ptr = ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> descendants_of (cref, oref) (cdt sa) = {} \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot sa \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)) \<and> ct_active sa \<and> Q' sa) \<and> (\<not> reset \<longrightarrow> invs sa \<and> Q sa \<and> ct_active sa \<and> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr && ~~ mask sz) sz idx = c) (cref, oref) sa \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> idxa \<le> unat (ptr - ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot sa \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)))
 2. \<And>x. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace> liftE (do cap <- get_cap (cref, oref);
y <- set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref);
orefs <- retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
mapM_x (create_cap tp us (cref, oref) dev) (zip slots orefs)
od) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); Q s; reset \<longrightarrow> Q' s; invs s; ct_active s; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz idx); ptr_base = ptr && ~~ mask sz; idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> ?idx16 = idx \<and> (idx \<le> unat (ptr && mask sz) \<or> ptr = ptr && ~~ mask sz)) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz))
 2. \<And>x. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace> liftE (do cap <- get_cap (cref, oref);
y <- set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref);
orefs <- retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
mapM_x (create_cap tp us (cref, oref) dev) (zip slots orefs)
od) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> Q s \<and> ct_active s \<and> valid_untyped_inv_wcap (Retype (cref, oref) reset ptr_base ptr tp us slots dev) (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace> liftE (do cap <- get_cap (cref, oref);
y <- set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref);
orefs <- retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
mapM_x (create_cap tp us (cref, oref) dev) (zip slots orefs)
od) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>cap. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?P'482 cap ()\<rbrace> retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>rv s. ((\<exists>x\<in>set (zip slots rv). \<exists>xa. xa \<in> obj_refs (default_cap tp (snd x) us dev)) \<longrightarrow> valid_global_objs s \<and> valid_arch_state s \<and> pspace_aligned s \<and> (\<forall>ref\<in>set rv. is_aligned ref (obj_bits_api tp us))) \<and> (cref, oref) \<notin> fst ` set (zip slots rv) \<and> distinct (map fst (zip slots rv)) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> set rv \<subseteq> set (retype_addrs ptr tp (length slots) us)\<rbrace>
 2. \<And>cap. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?B180 cap\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref) \<lbrace>\<lambda>a b. (invs and caps_no_overlap ptr sz and pspace_no_overlap (up_aligned_area ptr sz) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (tp = CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> ((\<lambda>s. {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> range_cover ptr (?sz361 cap a) (obj_bits_api tp us) (length slots) \<and> (invs b \<and> Q b \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap dev (ptr && ~~ mask sz) sz idx) (cref, oref) b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots * 2 ^ obj_bits_api tp us) - 1} b \<and> caps_no_overlap ptr sz b) \<and> (invs and caps_no_overlap ptr sz and pspace_no_overlap (up_aligned_area ptr sz) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (tp = CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> (pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at (\<lambda>a. \<exists>idx. a = UntypedCap dev (ptr && ~~ mask sz) sz idx) (cref, oref) b \<and> valid_pspace b) \<and> retype_addrs ptr tp (length slots) us = retype_addrs ptr tp (length slots) us \<and> (pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at is_untyped_cap (cref, oref) b \<and> valid_pspace b) \<and> (pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at (\<lambda>a. obj_is_device tp dev = cap_is_device a) (cref, oref) b \<and> valid_pspace b) \<and> (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) (cref, oref) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) (cref, oref) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> (cte_wp_at is_untyped_cap (cref, oref) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots * 2 ^ obj_bits_api tp us) - 1} and K (range_cover ptr sz (obj_bits_api tp us) (length slots)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace) b \<and> (range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> valid_pspace b \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) b) \<and> K (range_cover ptr sz (obj_bits_api tp us) (length slots)) b \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at ((=) NullCap) x b \<and> valid_pspace b) \<and> (pspace_no_overlap (up_aligned_area ptr sz) and K (tp = CapTableObject \<longrightarrow> 0 < us) and K (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) and K (tp \<noteq> ArchObject ASIDPoolObj) and K (range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> ptr \<noteq> 0)) b \<and> (\<forall>x\<in>set slots. (pspace_no_overlap (up_aligned_area ptr sz) and ex_cte_cap_wp_to is_cnode_cap x and valid_pspace and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b) \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us) \<and> real_cte_at x b) \<and> ((\<lambda>s. \<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>x xa. ((\<lambda>s. \<not> cte_wp_at (\<lambda>a. r \<in> obj_refs a) (x, xa) s) and valid_pspace and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} and valid_mdb and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and (\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) cref s) and K (r \<notin> obj_refs NullCap \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots))) s) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> ((\<lambda>s. \<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> ?P'482 cap a b\<rbrace>
 3. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?Q179\<rbrace> get_cap (cref, oref) \<lbrace>?B180\<rbrace>
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); invs s \<and> Q s \<and> ct_active s \<and> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa) (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) (cref, oref) s \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> (idxa \<le> unat (ptr - ptr_base) \<or> reset \<and> ptr = ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}) \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s) \<and> (\<forall>slot\<in>set slots. real_cte_at slot s) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)) \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> ?Q179 s proof (prove)
goal (3 subgoals):
 1. \<And>cap. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?B180 cap\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref) \<lbrace>\<lambda>a b. (invs and caps_no_overlap ptr sz and pspace_no_overlap (up_aligned_area ptr sz) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (tp = CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> ((\<lambda>s. {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> range_cover ptr (?sz361 cap a) (obj_bits_api tp us) (length slots) \<and> (invs b \<and> Q b \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap dev (ptr && ~~ mask sz) sz idx) (cref, oref) b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots * 2 ^ obj_bits_api tp us) - 1} b \<and> caps_no_overlap ptr sz b) \<and> (invs and caps_no_overlap ptr sz and pspace_no_overlap (up_aligned_area ptr sz) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (tp = CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> (pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at (\<lambda>a. \<exists>idx. a = UntypedCap dev (ptr && ~~ mask sz) sz idx) (cref, oref) b \<and> valid_pspace b) \<and> retype_addrs ptr tp (length slots) us = retype_addrs ptr tp (length slots) us \<and> (pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at is_untyped_cap (cref, oref) b \<and> valid_pspace b) \<and> (pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at (\<lambda>a. obj_is_device tp dev = cap_is_device a) (cref, oref) b \<and> valid_pspace b) \<and> (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) (cref, oref) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) (cref, oref) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> (cte_wp_at is_untyped_cap (cref, oref) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots * 2 ^ obj_bits_api tp us) - 1} and K (range_cover ptr sz (obj_bits_api tp us) (length slots)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace) b \<and> (range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> valid_pspace b \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) b) \<and> K (range_cover ptr sz (obj_bits_api tp us) (length slots)) b \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at ((=) NullCap) x b \<and> valid_pspace b) \<and> (pspace_no_overlap (up_aligned_area ptr sz) and K (tp = CapTableObject \<longrightarrow> 0 < us) and K (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) and K (tp \<noteq> ArchObject ASIDPoolObj) and K (range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> ptr \<noteq> 0)) b \<and> (\<forall>x\<in>set slots. (pspace_no_overlap (up_aligned_area ptr sz) and ex_cte_cap_wp_to is_cnode_cap x and valid_pspace and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b) \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us) \<and> real_cte_at x b) \<and> ((\<lambda>s. \<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>x xa. ((\<lambda>s. \<not> cte_wp_at (\<lambda>a. r \<in> obj_refs a) (x, xa) s) and valid_pspace and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} and valid_mdb and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and (\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) cref s) and K (r \<notin> obj_refs NullCap \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots))) s) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> ((\<lambda>s. \<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> ((invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (tp = CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (tp = CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (tp = CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) b \<and> range_cover ptr sz (obj_bits_api tp us) (length slots)) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> set (retype_addrs ptr tp (length slots) us) \<subseteq> set (retype_addrs ptr tp (length slots) us)\<rbrace>
 2. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?Q179\<rbrace> get_cap (cref, oref) \<lbrace>?B180\<rbrace>
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); invs s \<and> Q s \<and> ct_active s \<and> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa) (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) (cref, oref) s \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> (idxa \<le> unat (ptr - ptr_base) \<or> reset \<and> ptr = ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}) \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s) \<and> (\<forall>slot\<in>set slots. real_cte_at slot s) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)) \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> ?Q179 s proof (prove)
goal (3 subgoals):
 1. \<And>cap. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?B180 cap\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref) \<lbrace>\<lambda>a b. invs b \<and> valid_pspace b \<and> distinct slots \<and> Q b \<and> ptr \<noteq> 0 \<and> caps_no_overlap ptr sz b \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> cte_wp_at is_untyped_cap (cref, oref) b \<and> (cref, oref) \<notin> set slots \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr (?sz361 cap ()) (obj_bits_api tp us) (length slots) \<and> cte_wp_at (\<lambda>a. obj_is_device tp dev = cap_is_device a) (cref, oref) b \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at (\<lambda>a. \<exists>idx. a = UntypedCap dev (ptr && ~~ mask sz) sz idx) (cref, oref) b \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} b \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs b = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) b \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) (cref, oref) b \<and> (\<forall>x\<in>set slots. real_cte_at x b \<and> fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> (\<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state b)))) r b) \<and> (\<exists>slot. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) slot b) \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to is_cnode_cap x b) \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) NullCap) x b) \<and> (\<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. valid_mdb b \<and> (\<forall>x xa. \<not> cte_wp_at (\<lambda>a. r \<in> obj_refs a) (x, xa) b))\<rbrace>
 2. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?Q179\<rbrace> get_cap (cref, oref) \<lbrace>?B180\<rbrace>
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); invs s \<and> Q s \<and> ct_active s \<and> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa) (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) (cref, oref) s \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> (idxa \<le> unat (ptr - ptr_base) \<or> reset \<and> ptr = ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}) \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s) \<and> (\<forall>slot\<in>set slots. real_cte_at slot s) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)) \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> ?Q179 s proof (prove)
goal (3 subgoals):
 1. \<And>cap. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?B180 cap\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref) \<lbrace>\<lambda>a b. invs b \<and> valid_pspace b \<and> distinct slots \<and> Q b \<and> ptr \<noteq> 0 \<and> caps_no_overlap ptr sz b \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> cte_wp_at is_untyped_cap (cref, oref) b \<and> (cref, oref) \<notin> set slots \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to is_cnode_cap x b) \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) NullCap) x b) \<and> range_cover ptr (?sz361 cap ()) (obj_bits_api tp us) (length slots) \<and> cte_wp_at (\<lambda>a. obj_is_device tp dev = cap_is_device a) (cref, oref) b \<and> (\<forall>x\<in>set slots. real_cte_at x b) \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at (\<lambda>a. \<exists>idx. a = UntypedCap dev (ptr && ~~ mask sz) sz idx) (cref, oref) b \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} b \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs b = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) b \<and> ((\<exists>r. r \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}) \<longrightarrow> valid_mdb b) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) (cref, oref) b \<and> (\<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state b)))) r b) \<and> (\<exists>slot. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) slot b) \<and> (\<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>x xa. \<not> cte_wp_at (\<lambda>a. r \<in> obj_refs a) (x, xa) b)\<rbrace>
 2. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?Q179\<rbrace> get_cap (cref, oref) \<lbrace>?B180\<rbrace>
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); invs s \<and> Q s \<and> ct_active s \<and> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa) (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) (cref, oref) s \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> (idxa \<le> unat (ptr - ptr_base) \<or> reset \<and> ptr = ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}) \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s) \<and> (\<forall>slot\<in>set slots. real_cte_at slot s) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)) \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> ?Q179 s proof (prove)
goal (3 subgoals):
 1. \<And>cap. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?B180 cap\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref) \<lbrace>\<lambda>r s. invs s \<and> distinct slots \<and> Q s \<and> ptr \<noteq> 0 \<and> caps_no_overlap ptr sz s \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> cte_wp_at is_untyped_cap (cref, oref) s \<and> (cref, oref) \<notin> set slots \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to is_cnode_cap x s) \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) NullCap) x s) \<and> range_cover ptr (?sz361 cap ()) (obj_bits_api tp us) (length slots) \<and> cte_wp_at (\<lambda>a. obj_is_device tp dev = cap_is_device a) (cref, oref) s \<and> (\<forall>x\<in>set slots. real_cte_at x s) \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>a. \<exists>idx. a = UntypedCap dev (ptr && ~~ mask sz) sz idx) (cref, oref) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) (cref, oref) s \<and> (\<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s) \<and> (\<exists>x. caps_of_state s (cref, oref) = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) (cref, oref) s \<and> (\<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>x xa. \<not> cte_wp_at (\<lambda>a. r \<in> obj_refs a) (x, xa) s)\<rbrace>
 2. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?Q179\<rbrace> get_cap (cref, oref) \<lbrace>?B180\<rbrace>
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); invs s \<and> Q s \<and> ct_active s \<and> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa) (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) (cref, oref) s \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> (idxa \<le> unat (ptr - ptr_base) \<or> reset \<and> ptr = ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}) \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s) \<and> (\<forall>slot\<in>set slots. real_cte_at slot s) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)) \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> ?Q179 s proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); bits_of cap = sz\<rbrakk> \<Longrightarrow> \<lbrace>?P'650 cap\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref) \<lbrace>\<lambda>r s. invs s \<and> distinct slots \<and> Q s \<and> ptr \<noteq> 0 \<and> caps_no_overlap ptr sz s \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> cte_wp_at is_untyped_cap (cref, oref) s \<and> (cref, oref) \<notin> set slots \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to is_cnode_cap x s) \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) NullCap) x s) \<and> range_cover ptr (?sz361 cap ()) (obj_bits_api tp us) (length slots) \<and> cte_wp_at (\<lambda>a. obj_is_device tp dev = cap_is_device a) (cref, oref) s \<and> (\<forall>x\<in>set slots. real_cte_at x s) \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>a. \<exists>idx. a = UntypedCap dev (ptr && ~~ mask sz) sz idx) (cref, oref) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) (cref, oref) s \<and> (\<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s) \<and> (\<exists>x. caps_of_state s (cref, oref) = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) (cref, oref) s \<and> (\<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>x xa. \<not> cte_wp_at (\<lambda>a. r \<in> obj_refs a) (x, xa) s)\<rbrace>
 2. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?Q179\<rbrace> get_cap (cref, oref) \<lbrace>\<lambda>cap. ?P'650 cap and K (bits_of cap = sz)\<rbrace>
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); invs s \<and> Q s \<and> ct_active s \<and> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa) (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) (cref, oref) s \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> (idxa \<le> unat (ptr - ptr_base) \<or> reset \<and> ptr = ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}) \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s) \<and> (\<forall>slot\<in>set slots. real_cte_at slot s) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)) \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> ?Q179 s proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); (case cap of UntypedCap x xa bits xb \<Rightarrow> bits | CNodeCap x radix_bits xa \<Rightarrow> radix_bits) = sz\<rbrakk> \<Longrightarrow> \<lbrace>?P'650 cap\<rbrace> set_cap (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref) \<lbrace>\<lambda>r s. invs s \<and> distinct slots \<and> Q s \<and> ptr \<noteq> 0 \<and> caps_no_overlap ptr sz s \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> cte_wp_at is_untyped_cap (cref, oref) s \<and> (cref, oref) \<notin> set slots \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to is_cnode_cap x s) \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) NullCap) x s) \<and> range_cover ptr (?sz361 cap ()) (obj_bits_api tp us) (length slots) \<and> cte_wp_at (\<lambda>a. obj_is_device tp dev = cap_is_device a) (cref, oref) s \<and> (\<forall>x\<in>set slots. real_cte_at x s) \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>a. \<exists>idx. a = UntypedCap dev (ptr && ~~ mask sz) sz idx) (cref, oref) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) (cref, oref) s \<and> (\<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s) \<and> (\<exists>x. caps_of_state s (cref, oref) = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) (cref, oref) s \<and> (\<forall>r\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>x xa. \<not> cte_wp_at (\<lambda>a. r \<in> obj_refs a) (x, xa) s)\<rbrace>
 2. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?Q179\<rbrace> get_cap (cref, oref) \<lbrace>\<lambda>cap. ?P'650 cap and K (bits_of cap = sz)\<rbrace>
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); invs s \<and> Q s \<and> ct_active s \<and> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa) (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) (cref, oref) s \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> (idxa \<le> unat (ptr - ptr_base) \<or> reset \<and> ptr = ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}) \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s) \<and> (\<forall>slot\<in>set slots. real_cte_at slot s) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)) \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> ?Q179 s proof (prove)
goal (3 subgoals):
 1. \<And>cap r. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); (case cap of UntypedCap x xa bits xb \<Rightarrow> bits | CNodeCap x radix_bits xa \<Rightarrow> radix_bits) = sz; r \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> \<lbrace>?P711 cap r\<rbrace> set_cap (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (cref, oref) \<lbrace>\<lambda>rv s. \<forall>x xa. \<not> cte_wp_at (\<lambda>a. r \<in> obj_refs a) (x, xa) s\<rbrace>
 2. range_cover ptr sz (obj_bits_api tp us) (length slots) \<Longrightarrow> \<lbrace>?Q179\<rbrace> get_cap (cref, oref) \<lbrace>\<lambda>cap. (\<lambda>s. (invs s \<and> (\<exists>cap. free_index_of cap \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base) \<and> is_untyped_cap cap \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base) \<le> 2 ^ cap_bits cap \<and> free_index_update (\<lambda>_. unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)) cap = UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)) \<and> cte_wp_at ((=) cap) (cref, oref) s)) \<and> distinct slots \<and> (Q s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr_base) (cref, oref) s \<and> (case ui of Retype slot reset ptr' ptr tp us slots dev' \<Rightarrow> (cref, oref) = slot \<and> dev' = dev) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base) \<le> 2 ^ sz) \<and> ptr \<noteq> 0 \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)))) (cref, oref) and caps_no_overlap ptr sz) s \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> ((\<lambda>s. if (cref, oref) = (cref, oref) then is_untyped_cap (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) else cte_wp_at is_untyped_cap (cref, oref) s) and cte_wp_at (\<lambda>_. True) (cref, oref)) s \<and> (cref, oref) \<notin> set slots \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap'. x \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> x \<in> cte_refs (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (interrupt_irq_node s) \<and> is_cnode_cap (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)))) (cref, oref) s \<and> ex_cte_cap_wp_to is_cnode_cap x s) \<and> (\<forall>x\<in>set slots. ((\<lambda>s. if x = (cref, oref) then NullCap = UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)) else cte_wp_at ((=) NullCap) x s) and cte_wp_at (\<lambda>_. True) (cref, oref)) s) \<and> range_cover ptr (?sz361 cap ()) (obj_bits_api tp us) (length slots) \<and> ((\<lambda>s. if (cref, oref) = (cref, oref) then obj_is_device tp dev = cap_is_device (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) else cte_wp_at (\<lambda>a. obj_is_device tp dev = cap_is_device a) (cref, oref) s) and cte_wp_at (\<lambda>_. True) (cref, oref)) s \<and> (\<forall>x\<in>set slots. real_cte_at x s) \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> ((\<lambda>s. if (cref, oref) = (cref, oref) then \<exists>idx. UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)) = UntypedCap dev (ptr && ~~ mask sz) sz idx else cte_wp_at (\<lambda>a. \<exists>idx. a = UntypedCap dev (ptr && ~~ mask sz) sz idx) (cref, oref) s) and cte_wp_at (\<lambda>_. True) (cref, oref)) s \<and> (invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base sz (if reset then 0 else idx))) (cref, oref) s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (cte_wp_at (\<lambda>c. cap_range c = cap_range (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)))) (cref, oref) and descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref)) s \<and> ((\<lambda>s. if (cref, oref) = (cref, oref) then is_untyped_cap (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) \<and> cap_bits (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) = sz \<and> obj_ref_of (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) = ptr && ~~ mask sz else cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) (cref, oref) s) and cte_wp_at (\<lambda>_. True) (cref, oref)) s \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> (\<exists>x. ((caps_of_state s)((cref, oref) \<mapsto> UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)))) (cref, oref) = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> ((\<lambda>s. if (cref, oref) = (cref, oref) then cap_is_device (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) else cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) (cref, oref) s) and cte_wp_at (\<lambda>_. True) (cref, oref)) s \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. ?P711 cap x s)) and K (bits_of cap = sz)\<rbrace>
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); invs s \<and> Q s \<and> ct_active s \<and> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa) (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) (cref, oref) s \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> (idxa \<le> unat (ptr - ptr_base) \<or> reset \<and> ptr = ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}) \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s) \<and> (\<forall>slot\<in>set slots. real_cte_at slot s) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)) \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> ?Q179 s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); invs s \<and> Q s \<and> ct_active s \<and> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa) (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) (cref, oref) s \<and> range_cover ptr sza (obj_bits_api tp us) (length slots) \<and> (idxa \<le> unat (ptr - ptr_base) \<or> reset \<and> ptr = ptr_base) \<and> ptr && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}) \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s) \<and> (\<forall>slot\<in>set slots. real_cte_at slot s) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)) \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (cref, oref) s \<longrightarrow> ((\<lambda>s. (invs s \<and> (\<exists>cap. free_index_of cap \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base) \<and> is_untyped_cap cap \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base) \<le> 2 ^ cap_bits cap \<and> free_index_update (\<lambda>_. unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)) cap = UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)) \<and> cte_wp_at ((=) cap) (cref, oref) s)) \<and> distinct slots \<and> (Q s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr_base) (cref, oref) s \<and> (case ui of Retype slot reset ptr' ptr tp us slots dev' \<Rightarrow> (cref, oref) = slot \<and> dev' = dev) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base) \<le> 2 ^ sz) \<and> ptr \<noteq> 0 \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)))) (cref, oref) and caps_no_overlap ptr sz) s \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> ((\<lambda>s. if (cref, oref) = (cref, oref) then is_untyped_cap (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) else cte_wp_at is_untyped_cap (cref, oref) s) and cte_wp_at (\<lambda>_. True) (cref, oref)) s \<and> (cref, oref) \<notin> set slots \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap'. x \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> x \<in> cte_refs (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) (interrupt_irq_node s) \<and> is_cnode_cap (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)))) (cref, oref) s \<and> ex_cte_cap_wp_to is_cnode_cap x s) \<and> (\<forall>x\<in>set slots. ((\<lambda>s. if x = (cref, oref) then NullCap = UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)) else cte_wp_at ((=) NullCap) x s) and cte_wp_at (\<lambda>_. True) (cref, oref)) s) \<and> range_cover ptr (?sz361 cap ()) (obj_bits_api tp us) (length slots) \<and> ((\<lambda>s. if (cref, oref) = (cref, oref) then obj_is_device tp dev = cap_is_device (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) else cte_wp_at (\<lambda>a. obj_is_device tp dev = cap_is_device a) (cref, oref) s) and cte_wp_at (\<lambda>_. True) (cref, oref)) s \<and> (\<forall>x\<in>set slots. real_cte_at x s) \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> ((\<lambda>s. if (cref, oref) = (cref, oref) then \<exists>idx. UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)) = UntypedCap dev (ptr && ~~ mask sz) sz idx else cte_wp_at (\<lambda>a. \<exists>idx. a = UntypedCap dev (ptr && ~~ mask sz) sz idx) (cref, oref) s) and cte_wp_at (\<lambda>_. True) (cref, oref)) s \<and> (invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base sz (if reset then 0 else idx))) (cref, oref) s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (cte_wp_at (\<lambda>c. cap_range c = cap_range (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)))) (cref, oref) and descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref)) s \<and> ((\<lambda>s. if (cref, oref) = (cref, oref) then is_untyped_cap (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) \<and> cap_bits (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) = sz \<and> obj_ref_of (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) = ptr && ~~ mask sz else cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) (cref, oref) s) and cte_wp_at (\<lambda>_. True) (cref, oref)) s \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> (\<exists>x. ((caps_of_state s)((cref, oref) \<mapsto> UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base)))) (cref, oref) = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> ((\<lambda>s. if (cref, oref) = (cref, oref) then cap_is_device (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) else cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) (cref, oref) s) and cte_wp_at (\<lambda>_. True) (cref, oref)) s \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> (if (xa, xb) = (cref, oref) then x \<notin> obj_refs (UntypedCap dev ptr_base sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - ptr_base))) else \<not> cte_wp_at (\<lambda>a. x \<in> obj_refs a) (xa, xb) s))) and K (bits_of cap = sz)) s proof (prove)
goal (1 subgoal):
 1. \<And>s cap sza idxa. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr && ~~ mask sza) sza idxa) (cref, oref) s; cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) (cref, oref) s; range_cover ptr sza (obj_bits_api tp us) (length slots); idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; ptr_base = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; cte_wp_at ((=) cap) (cref, oref) s\<rbrakk> \<Longrightarrow> (\<exists>cap. (case cap of UntypedCap x xa xb free_index \<Rightarrow> free_index) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza)) \<and> is_untyped_cap cap \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza)) \<le> 2 ^ cap_bits cap \<and> free_index_update (\<lambda>_. unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza))) cap = UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza))) \<and> cte_wp_at ((=) cap) (cref, oref) s) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sza) (cref, oref) s \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza)) \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza))))) (cref, oref) s \<and> caps_no_overlap ptr sz s \<and> cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap'. x \<in> cte_refs cap' (interrupt_irq_node s) \<longrightarrow> \<not> is_cnode_cap cap') (cref, oref) s) \<and> (\<forall>x\<in>set slots. (if x = (cref, oref) then NullCap = UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza))) else cte_wp_at ((=) NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) (cref, oref) s) \<and> range_cover ptr (?sz361 cap ()) (obj_bits_api tp us) (length slots) \<and> obj_is_device tp dev = dev \<and> cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sza..(ptr && ~~ mask sza) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sza) sz (if reset then 0 else idx))) (cref, oref) s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> cte_wp_at (\<lambda>c. cap_range c = untyped_range (UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza))))) (cref, oref) s \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza)))) \<and> cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> (\<forall>xa xb. if xa = cref \<and> xb = oref then x \<notin> obj_refs (UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza)))) else \<not> cte_wp_at (\<lambda>a. x \<in> obj_refs a) (xa, xb) s)) \<and> bits_of cap = sz proof (prove)
goal (1 subgoal):
 1. \<And>s cap sza idxa. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr && ~~ mask sza) sza idxa) (cref, oref) s; cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) (cref, oref) s; range_cover ptr sza (obj_bits_api tp us) (length slots); idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; ptr_base = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; cte_wp_at ((=) cap) (cref, oref) s\<rbrakk> \<Longrightarrow> (\<exists>cap. (case cap of UntypedCap x xa xb free_index \<Rightarrow> free_index) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza)) \<and> is_untyped_cap cap \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza)) \<le> 2 ^ cap_bits cap \<and> free_index_update (\<lambda>_. unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza))) cap = UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza))) \<and> cte_wp_at ((=) cap) (cref, oref) s) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sza) (cref, oref) s \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza)) \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza))))) (cref, oref) s \<and> caps_no_overlap ptr sz s \<and> cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap'. x \<in> cte_refs cap' (interrupt_irq_node s) \<longrightarrow> \<not> is_cnode_cap cap') (cref, oref) s) \<and> (\<forall>x\<in>set slots. (if x = (cref, oref) then NullCap = UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza))) else cte_wp_at ((=) NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) (cref, oref) s) \<and> True \<and> obj_is_device tp dev = dev \<and> cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sza..(ptr && ~~ mask sza) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> cte_wp_at ((=) (UntypedCap dev (ptr && ~~ mask sza) sz (if reset then 0 else idx))) (cref, oref) s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> cte_wp_at (\<lambda>c. cap_range c = untyped_range (UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza))))) (cref, oref) s \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza)))) \<and> cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. cte_wp_at (\<lambda>_. True) (cref, oref) s \<and> (\<forall>xa xb. if xa = cref \<and> xb = oref then x \<notin> obj_refs (UntypedCap dev (ptr && ~~ mask sza) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sza)))) else \<not> cte_wp_at (\<lambda>a. x \<in> obj_refs a) (xa, xb) s)) \<and> bits_of cap = sz proof (prove)
goal (1 subgoal):
 1. \<And>s capc. \<lbrakk>range_cover ptr sz (obj_bits_api tp us) (length slots); invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<and> caps_no_overlap ptr sz s \<and> (\<forall>x\<in>set slots. if x = (cref, oref) then NullCap = UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) else \<exists>cap. caps_of_state s x = Some cap \<and> NullCap = cap) \<and> obj_is_device tp dev = dev \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. if xa = cref \<and> xb = oref then x \<notin> obj_refs (UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) else \<nexists>cap. caps_of_state s (xa, xb) = Some cap \<and> x \<in> obj_refs cap) \<and> bits_of (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = sz proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))\<rbrakk> \<Longrightarrow> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> caps_no_overlap ptr sz s \<and> (\<forall>x\<in>set slots. x \<noteq> (cref, oref)) \<and> obj_is_device tp dev = dev \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> cap_range (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}\<rbrakk> \<Longrightarrow> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> caps_no_overlap ptr sz s \<and> (\<forall>x\<in>set slots. x \<noteq> (cref, oref)) \<and> obj_is_device tp dev = dev \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> ptr \<noteq> 0 \<and> caps_no_overlap ptr sz s \<and> obj_is_device tp dev = dev \<and> (\<forall>x\<in>set slots. x \<noteq> (cref, oref)) \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> dev = ?dev801 s \<and> ptr && ~~ mask sz = ?ptr_base801 s \<and> sz = ?sz801 s \<and> (if reset then 0 else idx) = ?idx801 s \<and> ?ptr801 s && ~~ mask (?sz801 s) = ?ptr_base801 s \<and> range_cover (?ptr801 s) (?sz801 s) (obj_bits_api (?tp801 s) (?us801 s)) (length (?slots801 s)) \<and> (?idx801 s \<le> unat (?ptr801 s - ?ptr_base801 s) \<or> reset \<and> ?ptr801 s = ?ptr_base801 s) \<and> ?ptr801 s && ~~ mask (?sz801 s) = ?ptr_base801 s \<and> (?tp801 s = CapTableObject \<longrightarrow> 0 < ?us801 s) \<and> (?tp801 s = Untyped \<longrightarrow> untyped_min_bits \<le> ?us801 s) \<and> (cref, oref) \<notin> set (?slots801 s) \<and> distinct (?slots801 s) \<and> (\<forall>slot\<in>set (?slots801 s). caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> ?tp801 s \<noteq> ArchObject ASIDPoolObj \<and> ?slots801 s \<noteq> [] \<and> (?dev801 s \<longrightarrow> ?tp801 s = Untyped \<or> is_frame_type (?tp801 s))
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (?ptr_base801 s) (?ptr801 s) (?tp801 s) (?us801 s) (?slots801 s) (?sz801 s) (?idx801 s) (?dev801 s)\<rbrakk> \<Longrightarrow> ptr \<noteq> 0 \<and> caps_no_overlap ptr sz s \<and> obj_is_device tp dev = dev \<and> (\<forall>x\<in>set slots. x \<noteq> (cref, oref)) \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> ((if reset then 0 else idx) \<le> unat (ptr - (ptr && ~~ mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz) \<and> ptr && ~~ mask sz = ptr && ~~ mask sz \<and> (tp = CapTableObject \<longrightarrow> 0 < us) \<and> (tp = Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (cref, oref) \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> tp \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp)
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> ptr \<noteq> 0 \<and> caps_no_overlap ptr sz s \<and> obj_is_device tp dev = dev \<and> (\<forall>x\<in>set slots. x \<noteq> (cref, oref)) \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> ptr \<noteq> 0 \<and> caps_no_overlap ptr sz s \<and> obj_is_device tp dev = dev \<and> (\<forall>x\<in>set slots. x \<noteq> (cref, oref)) \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} (cref, oref) s \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> obj_is_device tp dev = dev \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> obj_is_device tp dev = dev \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))) \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap (up_aligned_area ptr sz) s\<rbrakk> \<Longrightarrow> obj_is_device tp dev = dev \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))) \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap (up_aligned_area ptr sz) s\<rbrakk> \<Longrightarrow> valid_untyped_inv ui s
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap (up_aligned_area ptr sz) s; case ui of Retype slot reset ptr_base ptr tp us slots dev \<Rightarrow> obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> obj_is_device tp dev = dev \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))) \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap (up_aligned_area ptr sz) s; case ui of Retype slot reset ptr_base ptr tp us slots dev \<Rightarrow> obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> obj_is_device tp dev = dev \<and> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))) \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))) \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> (\<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap)) proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 8. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. fst x \<notin> set (retype_addrs ptr tp (length slots) us)
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 8. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (8 subgoals):
 1. \<And>s a b. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev; set (retype_addrs ptr tp (length slots) us) \<subseteq> up_aligned_area ptr sz; (a, b) \<in> set slots; a \<in> set (retype_addrs ptr tp (length slots) us)\<rbrakk> \<Longrightarrow> False
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 8. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (8 subgoals):
 1. \<And>s a b. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev; set (retype_addrs ptr tp (length slots) us) \<subseteq> up_aligned_area ptr sz; (a, b) \<in> set slots; a \<in> set (retype_addrs ptr tp (length slots) us); (a, b) \<noteq> (cref, oref) \<and> fst (a, b) \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> ex_cte_cap_wp_to (\<lambda>_. True) (a, b) s\<rbrakk> \<Longrightarrow> False
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 8. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (8 subgoals):
 1. \<And>s a b. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev; (a, b) \<in> set slots; a \<in> set (retype_addrs ptr tp (length slots) us); (a, b) \<noteq> (cref, oref) \<and> fst (a, b) \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> ex_cte_cap_wp_to (\<lambda>_. True) (a, b) s; a \<in> up_aligned_area ptr sz\<rbrakk> \<Longrightarrow> False
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 8. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 7. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 7. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 7. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 6. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 6. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<not> obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (5 subgoals):
 1. \<And>s x. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev; x \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; obj_at (nonempty_table (set (second_level_tables (arch_state s)))) x s\<rbrakk> \<Longrightarrow> False
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 5. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 4. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 3. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev; usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api tp us))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 2. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}. \<forall>xa xb. (xa = cref \<longrightarrow> xb \<noteq> oref) \<longrightarrow> (\<forall>cap. caps_of_state s (xa, xb) = Some cap \<longrightarrow> x \<notin> obj_refs cap) proof (prove)
goal (1 subgoal):
 1. \<And>s x xa xb cap. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev; x \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; xa = cref \<longrightarrow> xb \<noteq> oref; caps_of_state s (xa, xb) = Some cap; x \<in> obj_refs cap\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s x xa xb cap. \<lbrakk>invs s; Q s; ct_active s; reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (cref, oref) (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s; \<forall>slot\<in>set slots. real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = Untyped \<or> is_frame_type tp; caps_of_state s (cref, oref) = Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; invoke_untyped_proofs s (cref, oref) reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; obj_is_device tp dev = dev; x \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; xa = cref \<longrightarrow> xb \<noteq> oref; caps_of_state s (xa, xb) = Some cap; x \<in> obj_refs cap\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz 0)) \<and> (\<not> reset \<longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (UntypedCap dev (ptr && ~~ mask sz) sz idx)) proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrace>(=) s\<rbrace> invoke_untyped (Retype (cref, oref) reset ptr_base ptr tp us slots dev) \<lbrace>\<lambda>rv s. invs s \<and> Q s\<rbrace>, \<lbrace>\<lambda>_ s. invs s \<and> Q s\<rbrace>

goal:
No subgoals!