theory Detype_R

lemma deleteObjects_corres:
  "is_aligned base magnitude \<Longrightarrow> magnitude \<ge> 2 \<Longrightarrow>
   corres dc
      (\<lambda>s. einvs s
           \<and> s \<turnstile> (cap.UntypedCap d base magnitude idx)
           \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s
                     \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s)
           \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s
           \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s)
      (\<lambda>s. s \<turnstile>' (UntypedCap d base magnitude idx)
           \<and> valid_pspace' s)
      (delete_objects base magnitude) (deleteObjects base magnitude)" apply (simp add: deleteObjects_def2) apply (rule corres_stateAssert_implied[where P'=\<top>, simplified]) prefer 2 apply clarsimp apply (rule_tac cap="cap.UntypedCap d base magnitude idx" and ptr="(a,b)" and
                   s=s in detype_locale'.deletionIsSafe,
          simp_all add: detype_locale'_def
     detype_locale_def p_assoc_help invs_valid_pspace)[1] apply (simp add:valid_cap_simps) apply (simp add: bind_assoc[symmetric]) apply (rule corres_stateAssert_implied2) defer apply (erule ksASIDMapSafeI, assumption, assumption) apply (rule hoare_pre) apply (rule delete_objects_invs) apply fastforce apply (simp add: doMachineOp_def split_def) apply wp apply (clarsimp simp: valid_pspace'_def pspace_distinct'_def
                         pspace_aligned'_def) apply (rule conjI) subgoal by fastforce apply (clarsimp simp add: pspace_distinct'_def ps_clear_def
                             dom_if_None Diff_Int_distrib) apply (simp add: delete_objects_def) apply (rule_tac Q="\<lambda>_ s. valid_objs s \<and> valid_list s \<and>
           (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and>
                   descendants_range (cap.UntypedCap d base magnitude idx) cref s ) \<and>
           s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and>
           valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and>
           zombies_final s \<and> sym_refs (state_refs_of s) \<and>
           untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and>
           valid_global_refs s" and
         Q'="\<lambda>_ s. s \<turnstile>' capability.UntypedCap d base magnitude idx \<and>
                        valid_pspace' s" in corres_underlying_split) apply (rule corres_bind_return) apply (rule corres_guard_imp[where r=dc]) apply (rule corres_split[OF _ cNodeNoPartialOverlap]) apply (rule corres_machine_op[OF corres_Id], simp+) apply (rule no_fail_freeMemory, simp+) apply (wp hoare_vcg_ex_lift)+ apply auto[1] apply (auto elim: is_aligned_weaken) apply (rule corres_modify) apply (simp add: valid_pspace'_def) apply (rule state_relation_null_filterE, assumption,
           simp_all add: pspace_aligned'_cut pspace_distinct'_cut)[1] apply (simp add: detype_def, rule state.equality; simp add: detype_ext_def) apply (intro exI, fastforce) apply (rule ext, clarsimp simp add: null_filter_def) apply (rule sym, rule ccontr, clarsimp) apply (drule(4) cte_map_not_null_outside') apply (fastforce simp add: cte_wp_at_caps_of_state) apply simp apply (rule ext, clarsimp simp add: null_filter'_def
                           map_to_ctes_delete[simplified field_simps]) apply (rule sym, rule ccontr, clarsimp) apply (frule(2) pspace_relation_cte_wp_atI
                        [OF state_relation_pspace_relation]) apply (elim exE) apply (frule(4) cte_map_not_null_outside') apply (rule cte_wp_at_weakenE, erule conjunct1) apply (case_tac y, clarsimp) apply (clarsimp simp: valid_mdb'_def valid_mdb_ctes_def
                               valid_nullcaps_def) apply clarsimp apply (frule_tac cref="(aa, ba)" in cte_map_untyped_range,
               erule cte_wp_at_weakenE[OF _ TrueI], assumption+) apply simp apply (rule detype_pspace_relation[simplified],
              simp_all add: state_relation_pspace_relation valid_pspace_def)[1] apply (simp add: valid_cap'_def capAligned_def) apply (clarsimp simp: valid_cap_def, assumption) apply (fastforce simp add: detype_def detype_ext_def intro!: ekheap_relation_detype) apply (clarsimp simp: state_relation_def ghost_relation_of_heap
                           detype_def) apply (drule_tac t="gsUserPages s'" in sym) apply (drule_tac t="gsCNodes s'" in sym) apply (auto simp add: ups_of_heap_def cns_of_heap_def ext
                 split: option.splits kernel_object.splits)[1] apply (simp add: valid_mdb_def) apply (wp hoare_vcg_ex_lift hoare_vcg_ball_lift | wps |
          simp add: invs_def valid_state_def valid_pspace_def
                    descendants_range_def | wp (once) hoare_drop_imps)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. einvs s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (deleteObjects base magnitude) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- stateAssert (deletionIsSafe base magnitude) [];
y <- doMachineOp (freeMemory base magnitude);
y <- stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) [];
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- doMachineOp (freeMemory base magnitude);
y <- stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) [];
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od)
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_pspace' s'\<rbrakk> \<Longrightarrow> deletionIsSafe base magnitude s' proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_pspace' s'\<rbrakk> \<Longrightarrow> deletionIsSafe base magnitude s'
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- doMachineOp (freeMemory base magnitude);
y <- stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) [];
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) proof (prove)
goal (2 subgoals):
 1. \<And>s s' a b. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; invs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_pspace' s'; valid_list s; valid_sched s; s \<turnstile> cap.UntypedCap d base magnitude idx; untyped_children_in_mdb s; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; if_unsafe_then_cap s; valid_mdb s; valid_global_refs s; ct_active s\<rbrakk> \<Longrightarrow> deletionIsSafe base magnitude s'
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- doMachineOp (freeMemory base magnitude);
y <- stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) [];
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) proof (prove)
goal (2 subgoals):
 1. \<And>s s' a b. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; invs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_pspace' s'; valid_list s; valid_sched s; s \<turnstile> cap.UntypedCap d base magnitude idx; untyped_children_in_mdb s; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; if_unsafe_then_cap s; valid_mdb s; valid_global_refs s; ct_active s\<rbrakk> \<Longrightarrow> valid_untyped (cap.UntypedCap d base magnitude idx) s
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- doMachineOp (freeMemory base magnitude);
y <- stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) [];
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- doMachineOp (freeMemory base magnitude);
y <- stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) [];
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od;
stateAssert ksASIDMapSafe []
od) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od)
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; ?R26 s; ?R'26 s'\<rbrakk> \<Longrightarrow> ksASIDMapSafe s'
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> delete_objects base magnitude \<lbrace>\<lambda>y. ?R26\<rbrace>
 4. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od \<lbrace>\<lambda>y. ?R'26\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; ?R26 s; ?R'26 s'\<rbrakk> \<Longrightarrow> ksASIDMapSafe s'
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> delete_objects base magnitude \<lbrace>\<lambda>y. ?R26\<rbrace>
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od \<lbrace>\<lambda>y. ?R'26\<rbrace>
 4. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> delete_objects base magnitude \<lbrace>\<lambda>y. invs\<rbrace>
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od \<lbrace>\<lambda>y s'. pspace_aligned' s' \<and> pspace_distinct' s'\<rbrace>
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>?Q34\<rbrace> delete_objects base magnitude \<lbrace>\<lambda>y. invs\<rbrace>
 2. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrakk> \<Longrightarrow> ?Q34 s
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od \<lbrace>\<lambda>y s'. pspace_aligned' s' \<and> pspace_distinct' s'\<rbrace>
 4. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) (cap.UntypedCap ?dev37 base magnitude ?f37)) slot s \<and> descendants_range (cap.UntypedCap ?dev37 base magnitude ?f37) slot s) and invs and ct_active) s
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od \<lbrace>\<lambda>y s'. pspace_aligned' s' \<and> pspace_distinct' s'\<rbrace>
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od \<lbrace>\<lambda>y s'. pspace_aligned' s' \<and> pspace_distinct' s'\<rbrace>
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- do y <- do ms <- gets ksMachineState;
p <- select_f (freeMemory base magnitude ms);
modify (ksMachineState_update (\<lambda>_. snd p))
od;
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od \<lbrace>\<lambda>y s'. pspace_aligned' s' \<and> pspace_distinct' s'\<rbrace>
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrakk> \<Longrightarrow> \<forall>x\<in>fst (freeMemory base magnitude (ksMachineState s)). \<not> cNodePartialOverlap (gsCNodes (s\<lparr>ksMachineState := snd x\<rparr>)) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1) \<longrightarrow> pspace_aligned' (s\<lparr>ksMachineState := snd x, ksPSpace := \<lambda>xa. if base \<le> xa \<and> xa \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd x\<rparr>) xa, gsUserPages := \<lambda>xa. if base \<le> xa \<and> xa \<le> base + 2 ^ magnitude - 1 then None else gsUserPages (s\<lparr>ksMachineState := snd x\<rparr>) xa, gsCNodes := \<lambda>xa. if base \<le> xa \<and> xa \<le> base + 2 ^ magnitude - 1 then None else gsCNodes (s\<lparr>ksMachineState := snd x\<rparr>) xa\<rparr>) \<and> pspace_distinct' (s\<lparr>ksMachineState := snd x, ksPSpace := \<lambda>xa. if base \<le> xa \<and> xa \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd x\<rparr>) xa, gsUserPages := \<lambda>xa. if base \<le> xa \<and> xa \<le> base + 2 ^ magnitude - 1 then None else gsUserPages (s\<lparr>ksMachineState := snd x\<rparr>) xa, gsCNodes := \<lambda>xa. if base \<le> xa \<and> xa \<le> base + 2 ^ magnitude - 1 then None else gsCNodes (s\<lparr>ksMachineState := snd x\<rparr>) xa\<rparr>)
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s b. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_cap' (capability.UntypedCap d base magnitude idx) s; valid_objs' s; \<forall>x\<in>dom (ksPSpace s). is_aligned x (objBitsKO (the (ksPSpace s x))); \<forall>x\<in>dom (ksPSpace s). ps_clear x (objBitsKO (the (ksPSpace s x))) s; no_0_obj' s; valid_mdb' s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1); ((), b) \<in> fst (freeMemory base magnitude (ksMachineState s))\<rbrakk> \<Longrightarrow> (\<forall>x\<in>dom (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x). (base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 \<longrightarrow> is_aligned x (objBitsKO (the None))) \<and> ((base \<le> x \<longrightarrow> \<not> x \<le> base + 2 ^ magnitude - 1) \<longrightarrow> is_aligned x (objBitsKO (the (ksPSpace s x))))) \<and> (\<forall>x\<in>dom (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x). (base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 \<longrightarrow> ps_clear x (objBitsKO (the None)) (s\<lparr>ksMachineState := b, ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x\<rparr>)) \<and> ((base \<le> x \<longrightarrow> \<not> x \<le> base + 2 ^ magnitude - 1) \<longrightarrow> ps_clear x (objBitsKO (the (ksPSpace s x))) (s\<lparr>ksMachineState := b, ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x\<rparr>)))
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od) proof (prove)
goal (3 subgoals):
 1. \<And>s b. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_cap' (capability.UntypedCap d base magnitude idx) s; valid_objs' s; \<forall>x\<in>dom (ksPSpace s). is_aligned x (objBitsKO (the (ksPSpace s x))); \<forall>x\<in>dom (ksPSpace s). ps_clear x (objBitsKO (the (ksPSpace s x))) s; no_0_obj' s; valid_mdb' s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1); ((), b) \<in> fst (freeMemory base magnitude (ksMachineState s))\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x). (base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 \<longrightarrow> is_aligned x (objBitsKO (the None))) \<and> ((base \<le> x \<longrightarrow> \<not> x \<le> base + 2 ^ magnitude - 1) \<longrightarrow> is_aligned x (objBitsKO (the (ksPSpace s x))))
 2. \<And>s b. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_cap' (capability.UntypedCap d base magnitude idx) s; valid_objs' s; \<forall>x\<in>dom (ksPSpace s). is_aligned x (objBitsKO (the (ksPSpace s x))); \<forall>x\<in>dom (ksPSpace s). ps_clear x (objBitsKO (the (ksPSpace s x))) s; no_0_obj' s; valid_mdb' s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1); ((), b) \<in> fst (freeMemory base magnitude (ksMachineState s))\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x). (base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 \<longrightarrow> ps_clear x (objBitsKO (the None)) (s\<lparr>ksMachineState := b, ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x\<rparr>)) \<and> ((base \<le> x \<longrightarrow> \<not> x \<le> base + 2 ^ magnitude - 1) \<longrightarrow> ps_clear x (objBitsKO (the (ksPSpace s x))) (s\<lparr>ksMachineState := b, ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x\<rparr>))
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_cap' (capability.UntypedCap d base magnitude idx) s_; valid_objs' s_; \<forall>x\<in>dom (ksPSpace s_). is_aligned x (objBitsKO (the (ksPSpace s_ x))); \<forall>x\<in>dom (ksPSpace s_). ps_clear x (objBitsKO (the (ksPSpace s_ x))) s_; no_0_obj' s_; valid_mdb' s_; \<not> cNodePartialOverlap (gsCNodes s_) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1); ((), b_) \<in> fst (freeMemory base magnitude (ksMachineState s_))\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s_\<lparr>ksMachineState := snd ((), b_)\<rparr>) x). (base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 \<longrightarrow> is_aligned x (objBitsKO (the None))) \<and> ((base \<le> x \<longrightarrow> \<not> x \<le> base + 2 ^ magnitude - 1) \<longrightarrow> is_aligned x (objBitsKO (the (ksPSpace s_ x)))) proof (prove)
goal (2 subgoals):
 1. \<And>s b. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_cap' (capability.UntypedCap d base magnitude idx) s; valid_objs' s; \<forall>x\<in>dom (ksPSpace s). is_aligned x (objBitsKO (the (ksPSpace s x))); \<forall>x\<in>dom (ksPSpace s). ps_clear x (objBitsKO (the (ksPSpace s x))) s; no_0_obj' s; valid_mdb' s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1); ((), b) \<in> fst (freeMemory base magnitude (ksMachineState s))\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x). (base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 \<longrightarrow> ps_clear x (objBitsKO (the None)) (s\<lparr>ksMachineState := b, ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x\<rparr>)) \<and> ((base \<le> x \<longrightarrow> \<not> x \<le> base + 2 ^ magnitude - 1) \<longrightarrow> ps_clear x (objBitsKO (the (ksPSpace s x))) (s\<lparr>ksMachineState := b, ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes (s\<lparr>ksMachineState := snd ((), b)\<rparr>) x\<rparr>))
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (delete_objects base magnitude) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (do y <- do_machine_op (freeMemory base magnitude);
modify (detype {base..base + 2 ^ magnitude - 1})
od) (do y <- do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od;
modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>)
od) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r'113 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (do_machine_op (freeMemory base magnitude)) (do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od)
 2. \<And>rv rv'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; ?r'113 rv rv'\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (modify (detype {base..base + 2 ^ magnitude - 1})) (modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>))
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 4. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r'113 (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (do_machine_op (freeMemory base magnitude) >>= return) (do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od)
 2. \<And>rv rv'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; ?r'113 rv rv'\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (modify (detype {base..base + 2 ^ magnitude - 1})) (modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>))
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 4. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres dc ?Q117 ?Q'117 (do_machine_op (freeMemory base magnitude) >>= return) (do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od)
 2. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrakk> \<Longrightarrow> ?Q117 s
 3. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrakk> \<Longrightarrow> ?Q'117 s
 4. \<And>rv rv'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; dc rv rv'\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (modify (detype {base..base + 2 ^ magnitude - 1})) (modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>))
 5. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r'121 ?P121 ?P'121 (do_machine_op (freeMemory base magnitude)) (doMachineOp (freeMemory base magnitude))
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>?Q121\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>rv s. \<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d123 rv) base magnitude (?idx126 rv))) cref s \<and> valid_objs s \<and> pspace_aligned s\<rbrace>
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>?Q'121\<rbrace> doMachineOp (freeMemory base magnitude) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrakk> \<Longrightarrow> (?P121 and ?Q121) s
 5. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrakk> \<Longrightarrow> (?P'121 and ?Q'121) s
 6. \<And>rv rv'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; dc rv rv'\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (modify (detype {base..base + 2 ^ magnitude - 1})) (modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>))
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 8. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> no_fail ?Q135 (freeMemory base magnitude)
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>?Q121\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>rv s. \<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d123 rv) base magnitude (?idx126 rv))) cref s \<and> valid_objs s \<and> pspace_aligned s\<rbrace>
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>?Q'121\<rbrace> doMachineOp (freeMemory base magnitude) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q121) s
 5. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrakk> \<Longrightarrow> (?Q135 \<circ> ksMachineState and ?Q'121) s
 6. \<And>rv rv'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; dc rv rv'\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (modify (detype {base..base + 2 ^ magnitude - 1})) (modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>))
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 8. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>?Q121\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>rv s. (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap (?d123 ()) base magnitude (?idx126 ()))) (a, b) s) \<and> valid_objs s \<and> pspace_aligned s\<rbrace>
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>?Q'121\<rbrace> doMachineOp (freeMemory base magnitude) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q121) s
 4. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned base 2) \<circ> ksMachineState and ?Q'121) s
 5. \<And>rv rv'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; dc rv rv'\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (modify (detype {base..base + 2 ^ magnitude - 1})) (modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>))
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and (\<lambda>s. (\<exists>x xa. cte_wp_at ((=) (cap.UntypedCap (?d123 ()) base magnitude (?idx126 ()))) (x, xa) s) \<and> valid_objs s \<and> pspace_aligned s)) s
 2. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned base 2) \<circ> ksMachineState and (\<lambda>s. True)) s
 3. \<And>rv rv'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; dc rv rv'\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (modify (detype {base..base + 2 ^ magnitude - 1})) (modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>))
 4. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 5. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned base 2) \<circ> ksMachineState and (\<lambda>s. True)) s
 2. \<And>rv rv'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; dc rv rv'\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (modify (detype {base..base + 2 ^ magnitude - 1})) (modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>))
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) cref s \<and> descendants_range (cap.UntypedCap d base magnitude idx) cref s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 4. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> corres ?r26 (\<lambda>s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s) (\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s) (modify (detype {base..base + 2 ^ magnitude - 1})) (modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s x\<rparr>))
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_pspace' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (detype {base..base + 2 ^ magnitude - 1} s, s'\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x\<rparr>) \<in> state_relation
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (detype {base..base + 2 ^ magnitude - 1} s, s'\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x\<rparr>) \<in> state_relation
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> detype {base..base + 2 ^ magnitude - 1} s = kheap_update (?f192 s s') (ekheap_update (?ef192 s s') s)
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> \<exists>f' g' h'. s'\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x\<rparr> = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> null_filter (\<lambda>p. if base \<le> fst p \<and> fst p \<le> base + 2 ^ magnitude - 1 then None else caps_of_state s p) = null_filter (caps_of_state s)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> null_filter' (map_to_ctes (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)) = null_filter' (ctes_of s')
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 6. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 7. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 8. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 9. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 10. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> \<exists>f' g' h'. s'\<lparr>ksPSpace := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x, gsUserPages := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x, gsCNodes := \<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x\<rparr> = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> null_filter (\<lambda>p. if base \<le> fst p \<and> fst p \<le> base + 2 ^ magnitude - 1 then None else caps_of_state s p) = null_filter (caps_of_state s)
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> null_filter' (map_to_ctes (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)) = null_filter' (ctes_of s')
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 6. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 7. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 8. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 9. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> null_filter (\<lambda>p. if base \<le> fst p \<and> fst p \<le> base + 2 ^ magnitude - 1 then None else caps_of_state s p) = null_filter (caps_of_state s)
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> null_filter' (map_to_ctes (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)) = null_filter' (ctes_of s')
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 6. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 8. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s s' a b aa ba. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (aa, ba) s; descendants_range (cap.UntypedCap d base magnitude idx) (aa, ba) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> a; a \<le> base + 2 ^ magnitude - 1; caps_of_state s (a, b) \<noteq> Some cap.NullCap\<rbrakk> \<Longrightarrow> None = caps_of_state s (a, b)
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> null_filter' (map_to_ctes (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)) = null_filter' (ctes_of s')
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 6. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 8. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s s' a b aa ba y. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (aa, ba) s; descendants_range (cap.UntypedCap d base magnitude idx) (aa, ba) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> a; a \<le> base + 2 ^ magnitude - 1; y \<noteq> cap.NullCap; caps_of_state s (a, b) = Some y\<rbrakk> \<Longrightarrow> False
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> null_filter' (map_to_ctes (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)) = null_filter' (ctes_of s')
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 6. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 8. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>s s' a b aa ba y. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; descendants_range (cap.UntypedCap d base magnitude idx) (aa, ba) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> a; a \<le> base + 2 ^ magnitude - 1; y \<noteq> cap.NullCap; caps_of_state s (a, b) = Some y\<rbrakk> \<Longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (?p324 s s' a b aa ba y) s
 2. \<And>s s' a b aa ba y. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; descendants_range (cap.UntypedCap d base magnitude idx) (aa, ba) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> a; a \<le> base + 2 ^ magnitude - 1; y \<noteq> cap.NullCap; caps_of_state s (a, b) = Some y; fst (?p324 s s' a b aa ba y) \<notin> untyped_range (cap.UntypedCap d base magnitude idx)\<rbrakk> \<Longrightarrow> False
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> null_filter' (map_to_ctes (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)) = null_filter' (ctes_of s')
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 6. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 7. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 8. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 9. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s s' a b aa ba y. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; descendants_range (cap.UntypedCap d base magnitude idx) (aa, ba) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> a; a \<le> base + 2 ^ magnitude - 1; y \<noteq> cap.NullCap; caps_of_state s (a, b) = Some y; fst (a, b) \<notin> untyped_range (cap.UntypedCap d base magnitude idx)\<rbrakk> \<Longrightarrow> False
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> null_filter' (map_to_ctes (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)) = null_filter' (ctes_of s')
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 6. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 8. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> null_filter' (map_to_ctes (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)) = null_filter' (ctes_of s')
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s s' x a b. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> x; x \<le> base + 2 ^ magnitude - 1; ctes_of s' x \<noteq> Some (CTE capability.NullCap nullMDBNode)\<rbrakk> \<Longrightarrow> None = ctes_of s' x
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s s' x a b y. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> x; x \<le> base + 2 ^ magnitude - 1; y \<noteq> CTE capability.NullCap nullMDBNode; ctes_of s' x = Some y\<rbrakk> \<Longrightarrow> False
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s s' x a b y. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> x; x \<le> base + 2 ^ magnitude - 1; y \<noteq> CTE capability.NullCap nullMDBNode; ctes_of s' x = Some y; \<exists>c slot. cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap y) \<and> x = cte_map slot\<rbrakk> \<Longrightarrow> False
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s s' x a b y c slot. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> x; x \<le> base + 2 ^ magnitude - 1; y \<noteq> CTE capability.NullCap nullMDBNode; ctes_of s' x = Some y; cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap y) \<and> x = cte_map slot\<rbrakk> \<Longrightarrow> False
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s s' x a b y c slot. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> x; x \<le> base + 2 ^ magnitude - 1; y \<noteq> CTE capability.NullCap nullMDBNode; ctes_of s' x = Some y; cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap y) \<and> x = cte_map slot\<rbrakk> \<Longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (?p391 s s' x a b y c slot) s
 2. \<And>s s' x a b y c slot. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> x; x \<le> base + 2 ^ magnitude - 1; y \<noteq> CTE capability.NullCap nullMDBNode; ctes_of s' x = Some y; cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap y) \<and> x = cte_map slot; fst (?p391 s s' x a b y c slot) \<notin> untyped_range (cap.UntypedCap d base magnitude idx)\<rbrakk> \<Longrightarrow> False
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 6. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 8. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s s' x a b y c slot ca. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> x; x \<le> base + 2 ^ magnitude - 1; y \<noteq> CTE capability.NullCap nullMDBNode; ctes_of s' x = Some y; cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap y) \<and> x = cte_map slot; c = ca\<rbrakk> \<Longrightarrow> cap.NullCap \<noteq> ca
 2. \<And>s s' x a b y c slot. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> x; x \<le> base + 2 ^ magnitude - 1; y \<noteq> CTE capability.NullCap nullMDBNode; ctes_of s' x = Some y; cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap y) \<and> x = cte_map slot; fst slot \<notin> untyped_range (cap.UntypedCap d base magnitude idx)\<rbrakk> \<Longrightarrow> False
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 6. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 8. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s s' a b aa ba x2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> cte_map (aa, ba); cte_map (aa, ba) \<le> base + 2 ^ magnitude - 1; x2 \<noteq> nullMDBNode; ctes_of s' (cte_map (aa, ba)) = Some (CTE capability.NullCap x2); cte_wp_at ((=) cap.NullCap) (aa, ba) s\<rbrakk> \<Longrightarrow> False
 2. \<And>s s' x a b y c slot. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> x; x \<le> base + 2 ^ magnitude - 1; y \<noteq> CTE capability.NullCap nullMDBNode; ctes_of s' x = Some y; cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap y) \<and> x = cte_map slot; fst slot \<notin> untyped_range (cap.UntypedCap d base magnitude idx)\<rbrakk> \<Longrightarrow> False
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 6. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 8. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s s' x a b y c slot. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> x; x \<le> base + 2 ^ magnitude - 1; y \<noteq> CTE capability.NullCap nullMDBNode; ctes_of s' x = Some y; cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap y) \<and> x = cte_map slot; fst slot \<notin> untyped_range (cap.UntypedCap d base magnitude idx)\<rbrakk> \<Longrightarrow> False
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s s' a b y c aa ba. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> cte_map (aa, ba); cte_map (aa, ba) \<le> base + 2 ^ magnitude - 1; y \<noteq> CTE capability.NullCap nullMDBNode; ctes_of s' (cte_map (aa, ba)) = Some y; base \<le> aa \<longrightarrow> \<not> aa \<le> base + 2 ^ magnitude - 1; cte_wp_at ((=) c) (aa, ba) s; cap_relation c (cteCap y)\<rbrakk> \<Longrightarrow> False
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s s' a b y c aa ba. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; (s, s') \<in> state_relation; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; valid_list s; valid_objs' s'; pspace_aligned' s'; s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); untyped_children_in_mdb s; if_unsafe_then_cap s; valid_global_refs s; base \<le> cte_map (aa, ba); cte_map (aa, ba) \<le> base + 2 ^ magnitude - 1; y \<noteq> CTE capability.NullCap nullMDBNode; ctes_of s' (cte_map (aa, ba)) = Some y; base \<le> aa \<longrightarrow> \<not> aa \<le> base + 2 ^ magnitude - 1; cte_wp_at ((=) c) (aa, ba) s; cap_relation c (cteCap y); (cte_map (aa, ba) \<in> untyped_range (cap.UntypedCap d base magnitude idx)) = (fst (aa, ba) \<in> untyped_range (cap.UntypedCap d base magnitude idx))\<rbrakk> \<Longrightarrow> False
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> pspace_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 5. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> magnitude < word_bits
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> valid_untyped (cap.UntypedCap (?d419 s s') base magnitude (?idx419 s s')) s
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 5. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 7. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> valid_untyped (cap.UntypedCap (?d419 s s') base magnitude (?idx419 s s')) s
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 4. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 5. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 6. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else ksPSpace s' x)
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 3. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 4. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 5. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ghost_relation (kheap (detype {base..base + 2 ^ magnitude - 1} s)) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 4. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s s' a b. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; pspace_relation (kheap s) (ksPSpace s'); valid_list s; valid_objs' s'; ekheap_relation (ekheap s) (ksPSpace s'); pspace_aligned' s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); pspace_aligned s; no_0_obj' s'; valid_mdb' s'; ups_of_heap (kheap s) = gsUserPages s'; valid_mdb s; cns_of_heap (kheap s) = gsCNodes s'; pspace_distinct s; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); if_live_then_nonz_cap s; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); zombies_final s; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); sym_refs (state_refs_of s); (arch_state s, ksArchState s') \<in> arch_state_relation; untyped_children_in_mdb s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); if_unsafe_then_cap s; valid_global_refs s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> ups_of_heap (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else kheap s x) = (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) \<and> cns_of_heap (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else kheap s x) = (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 4. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s s' a b. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; pspace_relation (kheap s) (ksPSpace s'); valid_list s; valid_objs' s'; ekheap_relation (ekheap s) (ksPSpace s'); pspace_aligned' s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; cns_of_heap (kheap s) = gsCNodes s'; pspace_distinct s; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); if_live_then_nonz_cap s; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); zombies_final s; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); sym_refs (state_refs_of s); (arch_state s, ksArchState s') \<in> arch_state_relation; untyped_children_in_mdb s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); if_unsafe_then_cap s; valid_global_refs s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; gsUserPages s' = ups_of_heap (kheap s)\<rbrakk> \<Longrightarrow> ups_of_heap (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else kheap s x) = (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) \<and> cns_of_heap (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else kheap s x) = (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 4. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s s' a b. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s; valid_cap' (capability.UntypedCap d base magnitude idx) s'; pspace_relation (kheap s) (ksPSpace s'); valid_list s; valid_objs' s'; ekheap_relation (ekheap s) (ksPSpace s'); pspace_aligned' s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); s \<turnstile> cap.UntypedCap d base magnitude idx; cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s; descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s; pspace_distinct' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); pspace_aligned s; no_0_obj' s'; valid_mdb' s'; valid_mdb s; pspace_distinct s; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); if_live_then_nonz_cap s; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); zombies_final s; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); sym_refs (state_refs_of s); (arch_state s, ksArchState s') \<in> arch_state_relation; untyped_children_in_mdb s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); if_unsafe_then_cap s; valid_global_refs s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; gsUserPages s' = ups_of_heap (kheap s); gsCNodes s' = cns_of_heap (kheap s)\<rbrakk> \<Longrightarrow> ups_of_heap (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else kheap s x) = (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsUserPages s' x) \<and> cns_of_heap (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else kheap s x) = (\<lambda>x. if base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1 then None else gsCNodes s' x)
 2. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 4. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s s'. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude; valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s; valid_cap' (capability.UntypedCap d base magnitude idx) s' \<and> valid_objs' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_mdb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 3. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> ct_active s\<rbrace> do_machine_op (freeMemory base magnitude) \<lbrace>\<lambda>_ s. valid_objs s \<and> valid_list s \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap d base magnitude idx)) (a, b) s \<and> descendants_range (cap.UntypedCap d base magnitude idx) (a, b) s) \<and> s \<turnstile> cap.UntypedCap d base magnitude idx \<and> pspace_aligned s \<and> valid_mdb s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_global_refs s\<rbrace>
 2. \<lbrakk>is_aligned base magnitude; 2 \<le> magnitude\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> do y <- doMachineOp (freeMemory base magnitude);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. base \<le> x \<and> x \<le> base + 2 ^ magnitude - 1)) []
od \<lbrace>\<lambda>_ s. valid_cap' (capability.UntypedCap d base magnitude idx) s \<and> valid_pspace' s\<rbrace> proof (prove)
goal:
No subgoals!