theory Untyped_AI

lemma reset_untyped_cap_invs_etc:
  "\<lbrace>invs and valid_untyped_inv_wcap ui
      (Some (UntypedCap dev ptr sz idx))
         and ct_active
         and K (\<exists>ptr_base ptr' ty us slots. ui = Retype slot True ptr_base ptr' ty us slots dev)\<rbrace>
    reset_untyped_cap slot
  \<lbrace>\<lambda>_. invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz 0))
      and ct_active
      and pspace_no_overlap {ptr .. ptr + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace>"
  (is "\<lbrace>invs and valid_untyped_inv_wcap ?ui (Some ?cap) and ct_active and _\<rbrace>
    ?f \<lbrace>\<lambda>_. invs and ?vu2 and ct_active and ?psp\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace>") apply (simp add: reset_untyped_cap_def) apply (rule hoare_vcg_seqE[rotated]) apply ((wp (once) get_cap_sp)+)[1] apply (rule hoare_name_pre_stateE) apply (clarsimp simp: cte_wp_at_caps_of_state bits_of_def split del: if_split) apply (subgoal_tac "is_aligned ptr sz") prefer 2 apply (frule caps_of_state_valid_cap, clarsimp) apply auto[1] apply (cases "idx = 0") apply (clarsimp simp: free_index_of_def) apply wp apply clarsimp apply (frule(1) caps_of_state_pspace_no_overlapD, simp+) apply (simp add: word_bw_assocs field_simps) apply (clarsimp simp: free_index_of_def split del: if_split) apply (rule_tac B="\<lambda>_. invs and valid_untyped_inv_wcap ?ui (Some ?cap)
        and ct_active and ?psp" in hoare_vcg_seqE[rotated]) apply clarsimp apply (rule hoare_pre) apply (wp hoare_vcg_ex_lift hoare_vcg_const_Ball_lift
              delete_objects_ex_cte_cap_wp_to[where src_slot=slot]
              ) apply (clarsimp simp: cte_wp_at_caps_of_state ct_in_state_def) apply (frule if_unsafe_then_capD[OF caps_of_state_cteD], clarsimp+) apply (drule(1) ex_cte_cap_protects[OF _ caps_of_state_cteD _ _ order_refl]) apply (simp add: empty_descendants_range_in) apply clarsimp+ apply (strengthen ballEI[mk_strg I E] refl) apply (strengthen exI[where x="fst slot"], strengthen exI[where x="snd slot"]) apply (strengthen ex_cte_cap_protects[OF _ caps_of_state_cteD _ _ order_refl, mk_strg D E]) apply (simp add: empty_descendants_range_in invs_untyped_children
                    invs_valid_global_refs descendants_range_def bits_of_def) apply (strengthen refl) apply (drule st_tcb_ex_cap, clarsimp, fastforce) apply (drule ex_nonz_cap_to_overlap[where p=slot],
     (simp add: cte_wp_at_caps_of_state descendants_range_def)+) apply (drule caps_of_state_valid_cap | clarify)+ apply (intro conjI; clarify?; blast)[1] apply (cases "dev \<or> sz < resetChunkBits") apply (simp add: bits_of_def) apply (simp add: unless_def) apply (rule hoare_pre) apply (wp set_untyped_cap_invs_simple set_cap_cte_wp_at set_cap_no_overlap
              hoare_vcg_const_Ball_lift set_cap_cte_cap_wp_to
              ct_in_state_thread_state_lift) apply (strengthen empty_descendants_range_in) apply (rule hoare_lift_Pf2 [where f="interrupt_irq_node"]) apply (wp hoare_vcg_const_Ball_lift hoare_vcg_const_imp_lift
               hoare_vcg_ex_lift ct_in_state_thread_state_lift)+ apply (clarsimp simp add: bits_of_def field_simps cte_wp_at_caps_of_state
                             empty_descendants_range_in) apply (cut_tac a=sz and b=resetChunkBits and n=idx in upt_mult_lt_prop) apply (frule caps_of_state_valid_cap, clarsimp+) apply (simp add: valid_cap_def) apply simp apply (clarsimp simp: bits_of_def free_index_of_def) apply (rule hoare_pre, rule hoare_post_impErr,
    rule_tac P="\<lambda>i. invs and ?psp and ct_active and valid_untyped_inv_wcap ?ui
        (Some (UntypedCap dev ptr sz (if i = 0 then idx else (bd - i) * 2 ^ resetChunkBits)))"
      and E="\<lambda>_. invs"
      in mapME_x_validE_nth) apply (rule hoare_pre) apply (wp set_untyped_cap_invs_simple
                set_cap_no_overlap set_cap_cte_wp_at
                preemption_point_inv
                hoare_vcg_ex_lift hoare_vcg_const_imp_lift
                hoare_vcg_const_Ball_lift set_cap_cte_cap_wp_to
                | strengthen empty_descendants_range_in
                | simp
                | rule irq_state_independent_A_conjI
                | simp add: cte_wp_at_caps_of_state
                | wp (once) ct_in_state_thread_state_lift
                | (rule irq_state_independent_A_def[THEN meta_eq_to_obj_eq, THEN iffD2],
                  simp add: ex_cte_cap_wp_to_def ct_in_state_def))+ apply (clarsimp simp: bits_of_def field_simps cte_wp_at_caps_of_state nth_rev) apply (strengthen order_trans[where z="2 ^ sz", rotated, mk_strg I E]) apply (clarsimp split: if_split_asm) apply auto[1] apply (auto elim: order_trans[rotated])[1] apply (clarsimp simp: cte_wp_at_caps_of_state split: if_split_asm) apply simp apply (clarsimp simp: cte_wp_at_caps_of_state) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Retype slot True ptr_base ptr' ty us slots dev)\<rbrace> reset_untyped_cap slot \<lbrace>\<lambda>_. invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz 0)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and (\<lambda>y. \<exists>ptr_base ptr' ty us slots. ui = Retype slot True ptr_base ptr' ty us slots dev)\<rbrace> doE cap <- liftE (get_cap slot);
if free_index_of cap = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of cap) (bits_of cap);
dev <- returnOk $ is_device_untyped_cap cap;
if dev \<or> bits_of cap < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of cap) (2 ^ bits_of cap);
set_cap (UntypedCap dev (obj_ref_of cap) (bits_of cap) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of cap + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of cap) (bits_of cap) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of cap) [0..<2 ^ (bits_of cap - resetChunkBits)]))
odE
odE \<lbrace>\<lambda>_. invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz 0)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and (\<lambda>y. \<exists>ptr_base ptr' ty us slots. ui = Retype slot True ptr_base ptr' ty us slots dev)\<rbrace> liftE (get_cap slot) \<lbrace>?B\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>cap. \<lbrace>?B cap\<rbrace> if free_index_of cap = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of cap) (bits_of cap);
dev <- returnOk $ is_device_untyped_cap cap;
if dev \<or> bits_of cap < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of cap) (2 ^ bits_of cap);
set_cap (UntypedCap dev (obj_ref_of cap) (bits_of cap) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of cap + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of cap) (bits_of cap) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of cap) [0..<2 ^ (bits_of cap - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz 0)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>cap. \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and (\<lambda>y. \<exists>ptr_base ptr' ty us slots. ui = Retype slot True ptr_base ptr' ty us slots dev) and cte_wp_at (\<lambda>c. c = cap) slot\<rbrace> if free_index_of cap = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of cap) (bits_of cap);
dev <- returnOk $ is_device_untyped_cap cap;
if dev \<or> bits_of cap < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of cap) (2 ^ bits_of cap);
set_cap (UntypedCap dev (obj_ref_of cap) (bits_of cap) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of cap + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of cap) (bits_of cap) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of cap) [0..<2 ^ (bits_of cap - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz 0)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>cap s. (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and (\<lambda>y. \<exists>ptr_base ptr' ty us slots. ui = Retype slot True ptr_base ptr' ty us slots dev) and cte_wp_at (\<lambda>c. c = cap) slot) s \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of cap = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of cap) (bits_of cap);
dev <- returnOk $ is_device_untyped_cap cap;
if dev \<or> bits_of cap < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of cap) (2 ^ bits_of cap);
set_cap (UntypedCap dev (obj_ref_of cap) (bits_of cap) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of cap + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of cap) (bits_of cap) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of cap) [0..<2 ^ (bits_of cap - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz 0)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
deva <- returnOk $ is_device_untyped_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx);
if deva \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; is_aligned ptr sz\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
deva <- returnOk $ is_device_untyped_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx);
if deva \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty\<rbrakk> \<Longrightarrow> is_aligned ptr sz proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty\<rbrakk> \<Longrightarrow> is_aligned ptr sz
 2. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; is_aligned ptr sz\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
deva <- returnOk $ is_device_untyped_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx);
if deva \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; s \<turnstile> UntypedCap dev (ptr' && ~~ mask sz) sz idx\<rbrakk> \<Longrightarrow> is_aligned ptr sz
 2. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; is_aligned ptr sz\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
deva <- returnOk $ is_device_untyped_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx);
if deva \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; is_aligned ptr sz\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
deva <- returnOk $ is_device_untyped_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx);
if deva \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; is_aligned ptr sz; idx = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
deva <- returnOk $ is_device_untyped_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx);
if deva \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; is_aligned ptr sz; idx \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
deva <- returnOk $ is_device_untyped_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx);
if deva \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; idx = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> returnOk () \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; is_aligned ptr sz; idx \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
deva <- returnOk $ is_device_untyped_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx);
if deva \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; idx = 0; s = sa\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa
 2. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; is_aligned ptr sz; idx \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
deva <- returnOk $ is_device_untyped_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx);
if deva \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; ct_active sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; idx = 0\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} sa
 2. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; is_aligned ptr sz; idx \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
deva <- returnOk $ is_device_untyped_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx);
if deva \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; ct_active sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; idx = 0; pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + (2 ^ sz - 1)} sa\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} sa
 2. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; is_aligned ptr sz; idx \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
deva <- returnOk $ is_device_untyped_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx);
if deva \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; is_aligned ptr sz; idx \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> if free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
deva <- returnOk $ is_device_untyped_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx);
if deva \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap deva (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> doE y <- liftE (delete_objects (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)));
if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)]))
odE \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftE (delete_objects (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx))) \<lbrace>\<lambda>_. invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> delete_objects (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) \<lbrace>\<lambda>_. invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q61 s ptr' ty us slots\<rbrace> delete_objects (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) \<lbrace>\<lambda>_. invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>
 2. \<And>s ptr' ty us slots sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; s = sa\<rbrakk> \<Longrightarrow> ?Q61 s ptr' ty us slots sa
 3. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. \<exists>slot. cte_wp_at ((=) (UntypedCap (?dev69 s ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 s ptr' ty us slots))) slot sa \<and> descendants_range (UntypedCap (?dev69 s ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 s ptr' ty us slots)) slot sa) and invs and ct_active) sa \<and> (\<exists>x xa. (cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) x xa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = a) slot sa \<and> fst slot \<notin> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1}) \<and> range_cover ptr' x (obj_bits_api ty us) (length slots) \<and> (xa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask x = ptr' && ~~ mask sz \<and> descendants_of slot (cdt sa) = {} \<and> (\<forall>x\<in>set slots. (cte_wp_at ((=) NullCap) x sa \<and> fst x \<notin> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1}) \<and> (ex_cte_cap_wp_to is_cnode_cap x and invs and cte_wp_at (\<lambda>cp. is_untyped_cap cp \<and> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1} \<subseteq> untyped_range cp) slot and (\<lambda>s. descendants_of slot (cdt s) = {})) sa \<and> real_cte_at x sa \<and> fst x \<notin> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1})) \<and> (ct_active sa \<and> cur_thread sa \<notin> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1}) \<and> (\<exists>deva idxa. sa \<turnstile> UntypedCap deva (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) idxa) \<and> pspace_aligned sa \<and> valid_objs sa \<and> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1}
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> (\<exists>a b. caps_of_state sa (a, b) = Some (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) \<and> descendants_range (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) (a, b) sa) \<and> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<forall>x\<in>set slots. (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<longrightarrow> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)) \<and> (ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<exists>deva idxa. sa \<turnstile> UntypedCap deva (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) idxa) \<and> pspace_aligned sa \<and> valid_objs sa \<and> (2 ^ sz = 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<or> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1 \<and> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; ex_cte_cap_wp_to (appropriate_cte_cap (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) slot sa\<rbrakk> \<Longrightarrow> (\<exists>a b. caps_of_state sa (a, b) = Some (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) \<and> descendants_range (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) (a, b) sa) \<and> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<forall>x\<in>set slots. (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<longrightarrow> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)) \<and> (ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<exists>deva idxa. sa \<turnstile> UntypedCap deva (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) idxa) \<and> pspace_aligned sa \<and> valid_objs sa \<and> (2 ^ sz = 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<or> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1 \<and> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> descendants_range_in (untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) slot sa
 2. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> untyped_children_in_mdb sa
 3. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> valid_global_refs sa
 4. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; fst slot \<notin> untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz idx)\<rbrakk> \<Longrightarrow> (\<exists>a b. caps_of_state sa (a, b) = Some (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) \<and> descendants_range (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) (a, b) sa) \<and> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<forall>x\<in>set slots. (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<longrightarrow> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)) \<and> (ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<exists>deva idxa. sa \<turnstile> UntypedCap deva (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) idxa) \<and> pspace_aligned sa \<and> valid_objs sa \<and> (2 ^ sz = 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<or> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1 \<and> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)
 5. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> untyped_children_in_mdb sa
 2. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> valid_global_refs sa
 3. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; fst slot \<notin> untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz idx)\<rbrakk> \<Longrightarrow> (\<exists>a b. caps_of_state sa (a, b) = Some (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) \<and> descendants_range (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) (a, b) sa) \<and> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<forall>x\<in>set slots. (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<longrightarrow> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)) \<and> (ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<exists>deva idxa. sa \<turnstile> UntypedCap deva (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) idxa) \<and> pspace_aligned sa \<and> valid_objs sa \<and> (2 ^ sz = 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<or> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1 \<and> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)
 4. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> (\<exists>a b. caps_of_state sa (a, b) = Some (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) \<and> descendants_range (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) (a, b) sa) \<and> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<forall>x\<in>set slots. (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<longrightarrow> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)) \<and> (ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<exists>deva idxa. sa \<turnstile> UntypedCap deva (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) idxa) \<and> pspace_aligned sa \<and> valid_objs sa \<and> (2 ^ sz = 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<or> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1 \<and> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> (\<exists>a b. caps_of_state sa (a, b) = Some (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) \<and> descendants_range (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) (a, b) sa) \<and> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<forall>x. x \<in> set slots \<longrightarrow> caps_of_state sa x = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap x sa \<and> real_cte_at x sa \<longrightarrow> (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<longrightarrow> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)) \<and> (ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<exists>deva idxa. sa \<turnstile> UntypedCap deva (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) idxa) \<and> pspace_aligned sa \<and> valid_objs sa \<and> (2 ^ sz = 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<or> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1 \<and> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> (caps_of_state sa (fst slot, snd slot) = Some (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) \<and> descendants_range (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) (fst slot, snd slot) sa) \<and> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<forall>x. x \<in> set slots \<longrightarrow> caps_of_state sa x = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap x sa \<and> real_cte_at x sa \<longrightarrow> (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<longrightarrow> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)) \<and> (ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<exists>deva idxa. sa \<turnstile> UntypedCap deva (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) idxa) \<and> pspace_aligned sa \<and> valid_objs sa \<and> (2 ^ sz = 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<or> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1 \<and> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> (caps_of_state sa (fst slot, snd slot) = Some (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) \<and> descendants_range (UntypedCap (?dev69 sa ptr' ty us slots) (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?f69 sa ptr' ty us slots)) (fst slot, snd slot) sa) \<and> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<forall>x. x \<in> set slots \<longrightarrow> caps_of_state sa x = Some NullCap \<and> (descendants_range_in (untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) slot sa \<longrightarrow> untyped_children_in_mdb sa \<longrightarrow> valid_global_refs sa \<longrightarrow> fst x \<notin> untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) \<and> real_cte_at x sa \<longrightarrow> (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<longrightarrow> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1 \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (ptr' && ~~ mask sz \<le> fst x \<longrightarrow> \<not> fst x \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)) \<and> (ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1) \<and> (\<exists>deva idxa. sa \<turnstile> UntypedCap deva (ptr' && ~~ mask sz) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) idxa) \<and> pspace_aligned sa \<and> valid_objs sa \<and> (2 ^ sz = 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<or> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1 \<and> \<not> ptr' && ~~ mask sz \<le> (ptr' && ~~ mask sz) + 2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - 1)
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> dev = ?dev69 sa ptr' ty us slots \<and> idx = ?f69 sa ptr' ty us slots \<and> (ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (\<exists>dev idx. sa \<turnstile> UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> pspace_aligned sa \<and> valid_objs sa
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; st_tcb_at active (cur_thread sa) sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> True \<and> True \<and> (ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (\<exists>dev idx. sa \<turnstile> UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> pspace_aligned sa \<and> valid_objs sa
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1; ex_nonz_cap_to (cur_thread sa) sa\<rbrakk> \<Longrightarrow> True \<and> True \<and> (ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (\<exists>dev idx. sa \<turnstile> UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> pspace_aligned sa \<and> valid_objs sa
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; caps_of_state sa slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1; ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> (\<exists>dev idx. sa \<turnstile> UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> pspace_aligned sa \<and> valid_objs sa
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ptr' ty us slots sa. \<lbrakk>invs sa; ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1; ptr' && ~~ mask sz \<le> cur_thread sa \<longrightarrow> \<not> cur_thread sa \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1; sa \<turnstile> UntypedCap dev (ptr' && ~~ mask sz) sz idx\<rbrakk> \<Longrightarrow> (\<exists>dev idx. sa \<turnstile> UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> pspace_aligned sa \<and> valid_objs sa
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace> do y <- unless dev (do_machine_op (clearMemory (ptr' && ~~ mask sz) (2 ^ sz)));
set_cap (UntypedCap dev (ptr' && ~~ mask sz) sz 0) slot
od \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace> do y <- when (\<not> dev) (do_machine_op (clearMemory (ptr' && ~~ mask sz) (2 ^ sz)));
set_cap (UntypedCap dev (ptr' && ~~ mask sz) sz 0) slot
od \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q1305 s ptr' ty us slots\<rbrace> do y <- when (\<not> dev) (do_machine_op (clearMemory (ptr' && ~~ mask sz) (2 ^ sz)));
set_cap (UntypedCap dev (ptr' && ~~ mask sz) sz 0) slot
od \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>
 2. \<And>s ptr' ty us slots sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> ?Q1305 s ptr' ty us slots sa
 3. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits; \<not> dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q1338 s ptr' ty us slots\<rbrace> do_machine_op (clearMemory (ptr' && ~~ mask sz) (2 ^ sz)) \<lbrace>\<lambda>y s. descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} slot s \<and> (pspace_no_overlap (up_aligned_area (ptr' && ~~ mask sz) sz) s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr' && ~~ mask sz) slot s \<and> 0 \<le> 2 ^ sz) \<and> ((caps_of_state s)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>x\<in>set slots. ((caps_of_state s)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) x = Some NullCap \<and> (cte_wp_at (\<lambda>cap'. x \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> x \<in> cte_refs (UntypedCap dev (ptr' && ~~ mask sz) sz 0) (interrupt_irq_node s) \<and> is_cnode_cap (UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot s \<and> ex_cte_cap_wp_to is_cnode_cap x s) \<and> real_cte_at x s) \<and> ct_active s \<and> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s\<rbrace>
 2. \<And>s ptr' ty us slots sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (if \<not> dev then ?Q1338 s ptr' ty us slots else (\<lambda>s. descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} slot s \<and> (pspace_no_overlap (up_aligned_area (ptr' && ~~ mask sz) sz) s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr' && ~~ mask sz) slot s \<and> 0 \<le> 2 ^ sz) \<and> ((caps_of_state s)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>x\<in>set slots. ((caps_of_state s)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) x = Some NullCap \<and> (cte_wp_at (\<lambda>cap'. x \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> x \<in> cte_refs (UntypedCap dev (ptr' && ~~ mask sz) sz 0) (interrupt_irq_node s) \<and> is_cnode_cap (UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot s \<and> ex_cte_cap_wp_to is_cnode_cap x s) \<and> real_cte_at x s) \<and> ct_active s \<and> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s)) sa
 3. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits; \<not> dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q1338 s ptr' ty us slots\<rbrace> do_machine_op (clearMemory (ptr' && ~~ mask sz) (2 ^ sz)) \<lbrace>\<lambda>r sa. descendants_of slot (cdt sa) = {} \<and> (pspace_no_overlap (up_aligned_area (ptr' && ~~ mask sz) sz) sa \<and> invs sa \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr' && ~~ mask sz) slot sa \<and> 0 \<le> 2 ^ sz) \<and> ((caps_of_state sa)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt sa) = {} \<and> (\<forall>x\<in>set slots. ((caps_of_state sa)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) x = Some NullCap \<and> (cte_wp_at (\<lambda>cap'. x \<in> cte_refs cap' (interrupt_irq_node sa) \<and> is_cnode_cap cap' \<longrightarrow> x \<in> cte_refs (UntypedCap dev (ptr' && ~~ mask sz) sz 0) (interrupt_irq_node sa) \<and> is_cnode_cap (UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot sa \<and> ex_cte_cap_wp_to is_cnode_cap x sa) \<and> real_cte_at x sa) \<and> ct_active sa \<and> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} sa\<rbrace>
 2. \<And>s ptr' ty us slots sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (if \<not> dev then ?Q1338 s ptr' ty us slots else (\<lambda>s. descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} slot s \<and> (pspace_no_overlap (up_aligned_area (ptr' && ~~ mask sz) sz) s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr' && ~~ mask sz) slot s \<and> 0 \<le> 2 ^ sz) \<and> ((caps_of_state s)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>x\<in>set slots. ((caps_of_state s)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) x = Some NullCap \<and> (cte_wp_at (\<lambda>cap'. x \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> x \<in> cte_refs (UntypedCap dev (ptr' && ~~ mask sz) sz 0) (interrupt_irq_node s) \<and> is_cnode_cap (UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot s \<and> ex_cte_cap_wp_to is_cnode_cap x s) \<and> real_cte_at x s) \<and> ct_active s \<and> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s)) sa
 3. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits; \<not> dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q1346 s ptr' ty us slots x\<rbrace> do_machine_op (clearMemory (ptr' && ~~ mask sz) (2 ^ sz)) \<lbrace>\<lambda>_ a. descendants_of slot (cdt a) = {} \<and> (pspace_no_overlap (up_aligned_area (ptr' && ~~ mask sz) sz) a \<and> invs a \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr' && ~~ mask sz) slot a \<and> 0 \<le> 2 ^ sz) \<and> ((caps_of_state a)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt a) = {} \<and> (\<forall>xa\<in>set slots. ((caps_of_state a)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) xa = Some NullCap \<and> (cte_wp_at (\<lambda>cap'. xa \<in> cte_refs cap' x \<and> is_cnode_cap cap' \<longrightarrow> xa \<in> cte_refs (UntypedCap dev (ptr' && ~~ mask sz) sz 0) x \<and> is_cnode_cap (UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot a \<and> ex_cte_cap_wp_to is_cnode_cap xa a) \<and> real_cte_at xa a) \<and> ct_active a \<and> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} a\<rbrace>
 2. \<And>s ptr' ty us slots P. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits; \<not> dev\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. P (interrupt_irq_node sa)\<rbrace> do_machine_op (clearMemory (ptr' && ~~ mask sz) (2 ^ sz)) \<lbrace>\<lambda>_ sa. P (interrupt_irq_node sa)\<rbrace>
 3. \<And>s ptr' ty us slots sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (if \<not> dev then \<lambda>sa. ?Q1346 s ptr' ty us slots (interrupt_irq_node sa) sa else (\<lambda>s. descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} slot s \<and> (pspace_no_overlap (up_aligned_area (ptr' && ~~ mask sz) sz) s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr' && ~~ mask sz) slot s \<and> 0 \<le> 2 ^ sz) \<and> ((caps_of_state s)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>x\<in>set slots. ((caps_of_state s)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) x = Some NullCap \<and> (cte_wp_at (\<lambda>cap'. x \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> x \<in> cte_refs (UntypedCap dev (ptr' && ~~ mask sz) sz 0) (interrupt_irq_node s) \<and> is_cnode_cap (UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot s \<and> ex_cte_cap_wp_to is_cnode_cap x s) \<and> real_cte_at x s) \<and> ct_active s \<and> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s)) sa
 4. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; dev \<or> sz < resetChunkBits; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (if \<not> dev then \<lambda>s. descendants_of slot (cdt s) = {} \<and> pspace_no_overlap (up_aligned_area (ptr' && ~~ mask sz) sz) s \<and> invs s \<and> (cte_wp_at (\<lambda>a. is_untyped_cap a \<and> cap_bits a = sz \<and> cap_is_device a = dev \<and> obj_ref_of a = ptr' && ~~ mask sz) slot s \<and> 0 \<le> 2 ^ sz) \<and> ((caps_of_state s)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>x\<in>set slots. ((caps_of_state s)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) x = Some NullCap \<and> cte_wp_at (\<lambda>a. x \<in> cte_refs a (interrupt_irq_node s) \<and> is_cnode_cap a \<longrightarrow> x \<in> cte_refs (UntypedCap dev (ptr' && ~~ mask sz) sz 0) (interrupt_irq_node s) \<and> is_cnode_cap (UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> real_cte_at x s) \<and> ct_active s \<and> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s else (\<lambda>s. descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} slot s \<and> (pspace_no_overlap (up_aligned_area (ptr' && ~~ mask sz) sz) s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr' && ~~ mask sz) slot s \<and> 0 \<le> 2 ^ sz) \<and> ((caps_of_state s)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>x\<in>set slots. ((caps_of_state s)(slot \<mapsto> UntypedCap dev (ptr' && ~~ mask sz) sz 0)) x = Some NullCap \<and> (cte_wp_at (\<lambda>cap'. x \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> x \<in> cte_refs (UntypedCap dev (ptr' && ~~ mask sz) sz 0) (interrupt_irq_node s) \<and> is_cnode_cap (UntypedCap dev (ptr' && ~~ mask sz) sz 0)) slot s \<and> ex_cte_cap_wp_to is_cnode_cap x s) \<and> real_cte_at x s) \<and> ct_active s \<and> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s)) sa
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> idx \<le> 2 ^ sz
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 3. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits); \<exists>bd. filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd] \<and> idx \<le> bd * 2 ^ resetChunkBits \<and> bd * 2 ^ resetChunkBits \<le> 2 ^ sz \<and> (bd - 1) * 2 ^ resetChunkBits \<le> idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s ptr' ty us slots. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; s \<turnstile> UntypedCap False (ptr' && ~~ mask sz) sz idx; \<not> dev; \<not> sz < resetChunkBits\<rbrakk> \<Longrightarrow> idx \<le> 2 ^ sz
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 3. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits); \<exists>bd. filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd] \<and> idx \<le> bd * 2 ^ resetChunkBits \<and> bd * 2 ^ resetChunkBits \<le> 2 ^ sz \<and> (bd - 1) * 2 ^ resetChunkBits \<le> idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 2. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits); \<exists>bd. filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd] \<and> idx \<le> bd * 2 ^ resetChunkBits \<and> bd * 2 ^ resetChunkBits \<le> 2 ^ sz \<and> (bd - 1) * 2 ^ resetChunkBits \<le> idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s ptr' ty us slots x. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots dev; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ty = Untyped \<or> is_frame_type ty; 0 < idx; \<not> (dev \<or> sz < resetChunkBits); \<exists>bd. filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd] \<and> idx \<le> bd * 2 ^ resetChunkBits \<and> bd * 2 ^ resetChunkBits \<le> 2 ^ sz \<and> (bd - 1) * 2 ^ resetChunkBits \<le> idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and ct_active and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1}\<rbrace> if dev \<or> bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (2 ^ bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx));
set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (UntypedCap dev (obj_ref_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) [0..<2 ^ (bits_of (UntypedCap dev (ptr' && ~~ mask sz) sz idx) - resetChunkBits)])) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap dev (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s ptr' ty us slots bd. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx\<rbrakk> \<Longrightarrow> \<lbrace>invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap False (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap False (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace> mapME_x (\<lambda>i. doE y <- liftE (do_machine_op (clearMemory ((ptr' && ~~ mask sz) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits)));
y <- liftE (set_cap (UntypedCap False (ptr' && ~~ mask sz) sz (i * 2 ^ resetChunkBits)) slot);
preemption_point
odE) (rev [0..<bd]) \<lbrace>\<lambda>_. invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s ptr' ty us slots bd i. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; i < length (rev [0..<bd])\<rbrakk> \<Longrightarrow> \<lbrace>invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if i = 0 then idx else (bd - i) * 2 ^ resetChunkBits)))\<rbrace> doE y <- liftE (do_machine_op (clearMemory ((ptr' && ~~ mask sz) + (word_of_nat (rev [0..<bd] ! i) << resetChunkBits)) (2 ^ resetChunkBits)));
y <- liftE (set_cap (UntypedCap False (ptr' && ~~ mask sz) sz (rev [0..<bd] ! i * 2 ^ resetChunkBits)) slot);
preemption_point
odE \<lbrace>\<lambda>y. invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if Suc i = 0 then idx else (bd - Suc i) * 2 ^ resetChunkBits)))\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>s ptr' ty us slots bd rv sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if length (rev [0..<bd]) = 0 then idx else (bd - length (rev [0..<bd])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa
 3. \<And>s ptr' ty us slots bd e sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; invs sa\<rbrakk> \<Longrightarrow> invs sa
 4. \<And>s ptr' ty us slots bd sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap False (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap False (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if 0 = 0 then idx else (bd - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>s ptr' ty us slots bd i. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; i < length (rev [0..<bd])\<rbrakk> \<Longrightarrow> \<lbrace>?Q1452 s ptr' ty us slots bd i\<rbrace> doE y <- liftE (do_machine_op (clearMemory ((ptr' && ~~ mask sz) + (word_of_nat (rev [0..<bd] ! i) << resetChunkBits)) (2 ^ resetChunkBits)));
y <- liftE (set_cap (UntypedCap False (ptr' && ~~ mask sz) sz (rev [0..<bd] ! i * 2 ^ resetChunkBits)) slot);
preemption_point
odE \<lbrace>\<lambda>y. invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if Suc i = 0 then idx else (bd - Suc i) * 2 ^ resetChunkBits)))\<rbrace>, \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>s ptr' ty us slots bd i sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; i < length (rev [0..<bd]); (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if i = 0 then idx else (bd - i) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> ?Q1452 s ptr' ty us slots bd i sa
 3. \<And>s ptr' ty us slots bd rv sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if length (rev [0..<bd]) = 0 then idx else (bd - length (rev [0..<bd])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa
 4. \<And>s ptr' ty us slots bd e sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; invs sa\<rbrakk> \<Longrightarrow> invs sa
 5. \<And>s ptr' ty us slots bd sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap False (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap False (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if 0 = 0 then idx else (bd - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s ptr' ty us slots bd i sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; i < bd; invs sa \<and> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} sa \<and> ct_active sa \<and> caps_of_state sa slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz (if i = 0 then idx else (bd - i) * 2 ^ resetChunkBits)) \<and> ((if i = 0 then idx else (bd - i) * 2 ^ resetChunkBits) \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> descendants_of slot (cdt sa) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa)\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + (2 ^ sz - 1)} sa \<and> rev [0..<bd] ! i * 2 ^ resetChunkBits \<le> 2 ^ sz \<and> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + (2 ^ sz - 1)} sa \<and> rev [0..<bd] ! i * 2 ^ resetChunkBits \<le> 2 ^ sz \<and> rev [0..<bd] ! i = bd - Suc i \<and> ((bd - Suc i) * 2 ^ resetChunkBits \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> (\<forall>x\<in>set slots. x \<noteq> slot)
 2. \<And>s ptr' ty us slots bd rv sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if length (rev [0..<bd]) = 0 then idx else (bd - length (rev [0..<bd])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa
 3. \<And>s ptr' ty us slots bd e sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; invs sa\<rbrakk> \<Longrightarrow> invs sa
 4. \<And>s ptr' ty us slots bd sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap False (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap False (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if 0 = 0 then idx else (bd - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s ptr' ty us slots bd i sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; i < bd; invs sa; pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} sa; ct_active sa; caps_of_state sa slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz (if i = 0 then idx else (bd - i) * 2 ^ resetChunkBits)); (if i = 0 then idx else (bd - i) * 2 ^ resetChunkBits) \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa\<rbrakk> \<Longrightarrow> (bd - Suc i) * 2 ^ resetChunkBits \<le> 2 ^ sz \<and> ((bd - Suc i) * 2 ^ resetChunkBits \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> (\<forall>x\<in>set slots. x \<noteq> slot)
 2. \<And>s ptr' ty us slots bd rv sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if length (rev [0..<bd]) = 0 then idx else (bd - length (rev [0..<bd])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa
 3. \<And>s ptr' ty us slots bd e sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; invs sa\<rbrakk> \<Longrightarrow> invs sa
 4. \<And>s ptr' ty us slots bd sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap False (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap False (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if 0 = 0 then idx else (bd - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s ptr' ty us slots bd i sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; i < bd; invs sa; pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} sa; ct_active sa; caps_of_state sa slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz (if i = 0 then idx else (bd - i) * 2 ^ resetChunkBits)); (if i = 0 then idx else (bd - i) * 2 ^ resetChunkBits) \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa\<rbrakk> \<Longrightarrow> (bd - Suc i) * 2 ^ resetChunkBits \<le> bd * 2 ^ resetChunkBits \<and> ((bd - Suc i) * 2 ^ resetChunkBits \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> (\<forall>x\<in>set slots. x \<noteq> slot)
 2. \<And>s ptr' ty us slots bd rv sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if length (rev [0..<bd]) = 0 then idx else (bd - length (rev [0..<bd])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa
 3. \<And>s ptr' ty us slots bd e sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; invs sa\<rbrakk> \<Longrightarrow> invs sa
 4. \<And>s ptr' ty us slots bd sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap False (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap False (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if 0 = 0 then idx else (bd - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>s ptr' ty us slots bd sa. \<lbrakk>descendants_of slot (cdt sa) = {}; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; 0 < bd; invs sa; pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} sa; ct_active sa; caps_of_state sa slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx)\<rbrakk> \<Longrightarrow> ((bd - Suc 0) * 2 ^ resetChunkBits \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> (\<forall>x\<in>set slots. x \<noteq> slot)
 2. \<And>s ptr' ty us slots bd i sa. \<lbrakk>(bd - i) * 2 ^ resetChunkBits \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; i < bd; invs sa; pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} sa; ct_active sa; 0 < i; caps_of_state sa slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz ((bd - i) * 2 ^ resetChunkBits))\<rbrakk> \<Longrightarrow> ((bd - Suc i) * 2 ^ resetChunkBits \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> (\<forall>x\<in>set slots. x \<noteq> slot)
 3. \<And>s ptr' ty us slots bd rv sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if length (rev [0..<bd]) = 0 then idx else (bd - length (rev [0..<bd])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa
 4. \<And>s ptr' ty us slots bd e sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; invs sa\<rbrakk> \<Longrightarrow> invs sa
 5. \<And>s ptr' ty us slots bd sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap False (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap False (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if 0 = 0 then idx else (bd - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s ptr' ty us slots bd i sa. \<lbrakk>(bd - i) * 2 ^ resetChunkBits \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; descendants_of slot (cdt sa) = {}; \<forall>slot\<in>set slots. caps_of_state sa slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot sa \<and> real_cte_at slot sa; invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; i < bd; invs sa; pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} sa; ct_active sa; 0 < i; caps_of_state sa slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz ((bd - i) * 2 ^ resetChunkBits))\<rbrakk> \<Longrightarrow> ((bd - Suc i) * 2 ^ resetChunkBits \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> (\<forall>x\<in>set slots. x \<noteq> slot)
 2. \<And>s ptr' ty us slots bd rv sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if length (rev [0..<bd]) = 0 then idx else (bd - length (rev [0..<bd])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa
 3. \<And>s ptr' ty us slots bd e sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; invs sa\<rbrakk> \<Longrightarrow> invs sa
 4. \<And>s ptr' ty us slots bd sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap False (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap False (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if 0 = 0 then idx else (bd - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (3 subgoals):
 1. \<And>s ptr' ty us slots bd rv sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if length (rev [0..<bd]) = 0 then idx else (bd - length (rev [0..<bd])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz 0) \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa
 2. \<And>s ptr' ty us slots bd e sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; invs sa\<rbrakk> \<Longrightarrow> invs sa
 3. \<And>s ptr' ty us slots bd sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap False (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap False (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if 0 = 0 then idx else (bd - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (2 subgoals):
 1. \<And>s ptr' ty us slots bd e sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; invs sa\<rbrakk> \<Longrightarrow> invs sa
 2. \<And>s ptr' ty us slots bd sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap False (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap False (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if 0 = 0 then idx else (bd - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (1 subgoal):
 1. \<And>s ptr' ty us slots bd sa. \<lbrakk>invs s; ct_active s; caps_of_state s slot = Some (UntypedCap False (ptr' && ~~ mask sz) sz idx); ui = Retype slot True (ptr' && ~~ mask sz) ptr' ty us slots False; range_cover ptr' sz (obj_bits_api ty us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ty = CapTableObject \<longrightarrow> 0 < us; ty = Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; ty \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; 0 < idx; \<not> dev; \<not> sz < resetChunkBits; filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)] = [0..<bd]; idx \<le> bd * 2 ^ resetChunkBits; bd * 2 ^ resetChunkBits \<le> 2 ^ sz; (bd - Suc 0) * 2 ^ resetChunkBits \<le> idx; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap False (ptr' && ~~ mask sz) sza idxa \<and> UntypedCap False (ptr' && ~~ mask sz) sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api ty us) (length slots) \<and> (idxa \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> ptr' && ~~ mask sza = ptr' && ~~ mask sz \<and> descendants_of slot (cdt s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s)) and ct_active and pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}) sa\<rbrakk> \<Longrightarrow> (invs and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and ct_active and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if 0 = 0 then idx else (bd - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal:
No subgoals!