theory Untyped_R

lemma inv_untyped_corres':
  "\<lbrakk> untypinv_relation ui ui' \<rbrakk> \<Longrightarrow>
   corres (dc \<oplus> (=))
     (einvs and valid_untyped_inv ui and ct_active)
     (invs' and valid_untyped_inv' ui' and ct_active')
     (invoke_untyped ui) (invokeUntyped ui')" apply (cases ui) apply (rule corres_name_pre) apply (clarsimp simp only: valid_untyped_inv_wcap
           valid_untyped_inv_wcap'
           Invocations_A.untyped_invocation.simps
           Invocations_H.untyped_invocation.simps
           untypinv_relation.simps) apply (rename_tac cref oref reset ptr ptr' dc us slots dev s s' ao' sz sz' idx idx') proof - fix cref reset ptr ptr_base us slots dev ao' sz sz' idx idx' s s' let ?ui = "Invocations_A.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev" let ?ui' = "Invocations_H.untyped_invocation.Retype
                  (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) dev" assume invs: "invs (s :: det_state)" "ct_active s" "valid_list s" "valid_sched s"
    and   invs': "invs' s'" "ct_active' s'"
    and      sr: "(s, s') \<in> state_relation"
    and     vui: "valid_untyped_inv_wcap ?ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s"
                 (is "valid_untyped_inv_wcap _ (Some ?cap) s")
    and    vui': "valid_untyped_inv_wcap' ?ui' (Some (UntypedCap dev (ptr && ~~ mask sz') sz' idx')) s'" assume   ui: "ui = ?ui" and ui': "ui' = ?ui'" have cte_at: "cte_wp_at ((=) ?cap) cref s" (is "?cte_cond s") using vui by (simp add:cte_wp_at_caps_of_state) have ptr_sz_simp[simp]: "ptr_base = ptr && ~~ mask sz \<and> sz' = sz \<and> idx' = idx \<and> 2 \<le> sz" using cte_at vui vui' sr invs apply (clarsimp simp: cte_wp_at_ctes_of) apply (drule pspace_relation_cte_wp_atI'[OF state_relation_pspace_relation]) apply (simp add:cte_wp_at_ctes_of) apply (simp add:invs_valid_objs) apply (clarsimp simp:is_cap_simps isCap_simps) apply (frule cte_map_inj_eq) apply ((erule cte_wp_at_weakenE | simp
          | clarsimp simp: cte_wp_at_caps_of_state)+)[5] apply (clarsimp simp:cte_wp_at_caps_of_state cte_wp_at_ctes_of) apply (drule caps_of_state_valid_cap,fastforce) apply (clarsimp simp:valid_cap_def untyped_min_bits_def) done have obj_bits_low_bound[simp]:
      "minUntypedSizeBits \<le> obj_bits_api (APIType_map2 (Inr ao')) us" using vui apply clarsimp apply (cases ao') apply (simp_all add: obj_bits_api_def slot_bits_def arch_kobj_size_def default_arch_object_def
                           APIType_map2_def untyped_min_bits_def minUntypedSizeBits_def
                    split: apiobject_type.splits) done have cover: "range_cover ptr sz
        (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)"
     and vslot: "slots\<noteq> []" using vui by (auto simp: cte_wp_at_caps_of_state) have misc'[simp]:
      "distinct (map cte_map slots)" using vui' by (auto simp: cte_wp_at_ctes_of) have intvl_eq[simp]:
    "ptr && ~~ mask sz = ptr \<Longrightarrow> {ptr + of_nat k |k. k < 2 ^ sz} = {ptr..ptr + 2 ^ sz - 1}" using cover apply (subgoal_tac "is_aligned (ptr &&~~ mask sz) sz") apply (rule intvl_range_conv) apply (simp) apply (drule range_cover.sz) apply simp apply (rule is_aligned_neg_mask,simp) done have delete_objects_rewrite:
      "ptr && ~~ mask sz = ptr \<Longrightarrow> delete_objects ptr sz =
      do y \<leftarrow> modify (clear_um {ptr + of_nat k |k. k < 2 ^ sz});
              modify (detype {ptr && ~~ mask sz..ptr + 2 ^ sz - 1})
      od" using cover apply (clarsimp simp:delete_objects_def freeMemory_def word_size_def) apply (subgoal_tac "is_aligned (ptr &&~~ mask sz) sz") apply (subst mapM_storeWord_clear_um[simplified word_size_def word_size_bits_def];
              clarsimp simp: range_cover_def word_bits_def) apply (rule is_aligned_neg_mask) apply simp done have of_nat_length: "(of_nat (length slots)::word32) - (1::word32) < (of_nat (length slots)::word32)" using vslot using range_cover.range_cover_le_n_less(1)[OF cover,where p = "length slots"] apply - apply (case_tac slots) apply clarsimp+ apply (subst add.commute) apply (subst word_le_make_less[symmetric]) apply (rule less_imp_neq) apply (simp add:word_bits_def minus_one_norm) apply (rule word_of_nat_less) apply auto done have not_0_ptr[simp]: "ptr\<noteq> 0" using cte_at invs apply (clarsimp simp:cte_wp_at_caps_of_state) apply (drule(1) caps_of_state_valid)+ apply (simp add:valid_cap_def) done have size_eq[simp]: "APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us" apply (case_tac ao') apply (rename_tac apiobject_type) apply (case_tac apiobject_type) apply (clarsimp simp: APIType_capBits_def objBits_simps' arch_kobj_size_def default_arch_object_def
                              obj_bits_api_def APIType_map2_def slot_bits_def pageBitsForSize_def)+ done have non_reset_idx_le[simp]: "\<not> reset \<Longrightarrow> idx < 2^sz" using vui apply (clarsimp simp: cte_wp_at_caps_of_state ) apply (erule le_less_trans) apply (rule unat_less_helper) apply simp apply (rule and_mask_less') using cover apply (clarsimp simp:range_cover_def) done note blah[simp del] = untyped_range.simps usable_untyped_range.simps atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff
          Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex usableUntypedRange.simps have vc'[simp] : "s' \<turnstile>' capability.UntypedCap dev (ptr && ~~ mask sz) sz idx" using vui' invs' apply (clarsimp simp:cte_wp_at_ctes_of) apply (case_tac cte) apply clarsimp apply (erule ctes_of_valid_cap') apply (simp add:invs_valid_objs') done have nidx[simp]: "ptr + (of_nat (length slots) * 2^obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)
      = (ptr && mask sz) + (of_nat (length slots) * 2^obj_bits_api (APIType_map2 (Inr ao')) us)" apply (subst word_plus_and_or_coroll2[symmetric,where w = "mask sz" and t = ptr]) apply simp done have idx_compare'[simp]:"unat ((ptr && mask sz) + (of_nat (length slots)<< obj_bits_api (APIType_map2 (Inr ao')) us)) \<le> 2 ^ sz" apply (rule le_trans[OF unat_plus_gt]) apply (simp add:range_cover.unat_of_nat_n_shift[OF cover] range_cover_unat) apply (insert range_cover.range_cover_compare_bound[OF cover]) apply simp done have idx_compare''[simp]:
       "unat ((ptr && mask sz) + (of_nat (length slots) * (2::word32) ^ obj_bits_api (APIType_map2 (Inr ao')) us)) < 2 ^ sz
        \<Longrightarrow> ptr + of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1
        < ptr + of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us" apply (rule word_leq_le_minus_one,simp) apply (rule neq_0_no_wrap) apply (rule machine_word_plus_mono_right_split) apply (simp add:shiftl_t2n range_cover_unat[OF cover] field_simps) apply (simp add:range_cover.sz[where 'a=32, folded word_bits_def, OF cover])+ done note neg_mask_add_mask = word_plus_and_or_coroll2[symmetric,where w = "mask sz" and t = ptr,symmetric] have idx_compare'''[simp]:
      "\<lbrakk>unat (of_nat (length slots) * (2::word32) ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz;
       ptr && ~~ mask sz = ptr\<rbrakk>
      \<Longrightarrow> ptr + of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1
      < ptr + of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us " apply (rule word_leq_le_minus_one,simp) apply (simp add:is_aligned_neg_mask_eq'[symmetric]) apply (rule neq_0_no_wrap) apply (rule machine_word_plus_mono_right_split[where sz = sz]) apply (simp add:is_aligned_mask)+ apply (simp add:range_cover.sz[where 'a=32, folded word_bits_def, OF cover])+ done have maxDomain:"ksCurDomain s' \<le> maxDomain" using invs' by (simp add:invs'_def valid_state'_def) have sz_mask_less:
      "unat (ptr && mask sz) < 2 ^ sz" using range_cover.sz[OF cover] by (simp add: unat_less_helper and_mask_less_size word_size) have overlap_ranges1:
      "{x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us
            * of_nat (length slots) - 1} \<subseteq> {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}" apply (rule order_trans[rotated]) apply (rule range_cover_subset'[OF cover], simp add: vslot) apply (clarsimp simp: atLeastAtMost_iff field_simps) done have overlap_ranges2:
      "idx \<le> unat (ptr && mask sz)
        \<Longrightarrow> {x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us
            * of_nat (length slots) - 1} \<subseteq> {(ptr && ~~ mask sz) + of_nat idx..(ptr && ~~ mask sz) + 2 ^ sz - 1}" apply (rule order_trans[OF overlap_ranges1]) apply (clarsimp simp add: atLeastatMost_subset_iff) apply (rule order_trans, rule word_plus_mono_right) apply (erule word_of_nat_le) apply (simp add: add.commute word_plus_and_or_coroll2 word_and_le2) apply (simp add: add.commute word_plus_and_or_coroll2) done have overlap_ranges:
     "{x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * of_nat (length slots) - 1}
         \<subseteq> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))" apply (cases reset, simp_all add: usable_untyped_range.simps) apply (rule order_trans, rule overlap_ranges1) apply (simp add: blah word_and_le2) apply (rule overlap_ranges2) apply (cut_tac vui) apply (clarsimp simp: cte_wp_at_caps_of_state) done note set_cap_free_index_invs_spec = set_free_index_invs[where cap = "cap.UntypedCap
        dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)"
      ,unfolded free_index_update_def free_index_of_def,simplified] note msimp[simp add] = neg_mask_add_mask note if_split[split del] show " corres (dc \<oplus> (=)) ((=) s) ((=) s')
           (invoke_untyped ?ui)
           (invokeUntyped ?ui')" apply (clarsimp simp: invokeUntyped_def invoke_untyped_def getSlotCap_def bind_assoc
                            archOverlap_def) apply (insert cover) apply (rule corres_guard_imp) apply (rule corres_split_norE) apply (rule corres_whenE, simp) apply (rule resetUntypedCap_corres[where ui=ui and ui'=ui']) apply (simp add: ui ui') apply simp apply simp apply (rule corres_symb_exec_l_Ex) apply (rule_tac F = "cap = cap.UntypedCap dev (ptr && ~~ mask sz)
                sz (if reset then 0 else idx)" in corres_gen_asm) apply (rule corres_add_noop_lhs) apply (rule corres_split_nor[OF cNodeNoOverlap _ return_wp stateAssert_wp]) apply (rule corres_split[OF updateFreeIndex_corres]) apply (simp add:isCap_simps)+ apply (clarsimp simp:getFreeIndex_def bits_of_def shiftL_nat shiftl_t2n
                                  free_index_of_def) apply (insert range_cover.range_cover_n_less[OF cover] vslot) apply (rule createNewObjects_corres_helper) apply simp+ apply (simp add: insertNewCaps_def) apply (rule corres_split_retype_createNewCaps[where sz = sz,OF corres_rel_imp]) apply (rule inv_untyped_corres_helper1) apply simp apply simp apply ((wp retype_region_invs_extras[where sz = sz]
                   retype_region_plain_invs [where sz = sz]
                   retype_region_descendants_range_ret[where sz = sz]
                   retype_region_caps_overlap_reserved_ret[where sz = sz]
                   retype_region_cte_at_other[where sz = sz]
                   retype_region_distinct_sets[where sz = sz]
                   retype_region_ranges[where p=cref and sz = sz]
                   retype_ret_valid_caps [where sz = sz]
                   retype_region_arch_objs [where sza = "\<lambda>_. sz"]
                   hoare_vcg_const_Ball_lift
                   set_tuple_pick distinct_tuple_helper
                   retype_region_obj_at_other3[where sz = sz]
                 | assumption)+)[1] apply (wp set_tuple_pick createNewCaps_cte_wp_at'[where sz= sz]
                 hoare_vcg_ex_lift distinct_tuple_helper
                 createNewCaps_parent_helper [where p="cte_map cref" and sz = sz]
                 createNewCaps_valid_pspace_extras [where ptr=ptr and sz = sz]
                 createNewCaps_ranges'[where sz = sz]
                 hoare_vcg_const_Ball_lift createNewCaps_valid_cap'[where sz = sz]
                 createNewCaps_descendants_range_ret'[where sz = sz]
                 createNewCaps_caps_overlap_reserved_ret'[where sz = sz]) apply clarsimp apply (erule cte_wp_at_weakenE') apply (case_tac c, simp) apply hypsubst apply (case_tac c,clarsimp simp:isCap_simps) apply (clarsimp simp: getFreeIndex_def is_cap_simps bits_of_def shiftL_nat) apply (clarsimp simp:conj_comms) apply (strengthen invs_mdb invs_valid_objs
              invs_valid_pspace invs_arch_state invs_psp_aligned
              caps_region_kernel_window_imp[where p=cref]
              invs_cap_refs_in_kernel_window)+ apply (clarsimp simp:conj_comms bits_of_def) apply (wp set_cap_free_index_invs_spec set_cap_caps_no_overlap set_cap_no_overlap) apply (rule hoare_vcg_conj_lift) apply (rule hoare_strengthen_post[OF set_cap_sets]) apply (clarsimp simp:cte_wp_at_caps_of_state) apply (wp set_cap_no_overlap hoare_vcg_ball_lift
                     set_cap_free_index_invs_spec
                     set_cap_descendants_range_in
                     set_untyped_cap_caps_overlap_reserved[where
                        idx="if reset then 0 else idx"]
                     set_cap_cte_wp_at
                     | strengthen exI[where x=cref])+ apply (clarsimp simp:conj_comms ball_conj_distrib simp del:capFreeIndex_update.simps) apply (strengthen invs_pspace_aligned' invs_pspace_distinct'
               invs_valid_pspace' invs_arch_state'
               imp_consequent[where Q = "(\<exists>x. x \<in> cte_map ` set slots)"]
             | clarsimp simp: conj_comms simp del: capFreeIndex_update.simps)+ apply ((wp updateFreeIndex_forward_invs' updateFreeIndex_caps_overlap_reserved
             updateFreeIndex_caps_no_overlap'' updateFreeIndex_pspace_no_overlap'
             hoare_vcg_const_Ball_lift updateFreeIndex_cte_wp_at
             updateFreeIndex_descendants_range_in')+)[1] apply clarsimp apply (clarsimp simp:conj_comms) apply (strengthen invs_mdb invs_valid_objs
                invs_valid_pspace invs_arch_state invs_psp_aligned
                invs_distinct) apply (clarsimp simp:conj_comms ball_conj_distrib ex_in_conv) apply (rule validE_R_validE, rule_tac Q'="\<lambda>_ s. valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s
          \<and> valid_untyped_inv_wcap ui
            (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s
          \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)
          " in hoare_post_imp_R) apply (simp add: whenE_def, wp) apply (rule validE_validE_R, rule hoare_post_impErr, rule reset_untyped_cap_invs_etc, auto)[1] apply wp apply (clarsimp simp: ui cte_wp_at_caps_of_state
                               bits_of_def untyped_range.simps) apply (frule(1) valid_global_refsD2[OF _ invs_valid_global_refs]) apply (cut_tac cref="cref" and reset=reset
           in invoke_untyped_proofs.intro,
           simp_all add: cte_wp_at_caps_of_state)[1] apply (rule conjI, (assumption | rule refl))+ apply (simp split: if_split) apply (simp add: invoke_untyped_proofs.simps) apply (strengthen if_split[where P="\<lambda>v. v \<le> unat x" for x, THEN iffD2]
                           exI[where x=cref]) apply (simp add: arg_cong[OF mask_out_sub_mask, where f="\<lambda>y. x - y" for x]
                          field_simps invoke_untyped_proofs.idx_le_new_offs
                          if_split[where P="\<lambda>v. v \<le> unat x" for x]) apply (frule range_cover.sz(1), fold word_bits_def) apply (frule cte_wp_at_pspace_no_overlapI,
           simp add: cte_wp_at_caps_of_state, simp split: if_split,
           simp add: invoke_untyped_proofs.szw) apply (simp add: field_simps conj_comms ex_in_conv
                          cte_wp_at_caps_of_state
                          in_get_cap_cte_wp_at
                          atLeastatMost_subset_iff[where b=x and d=x for x]
                          word_and_le2) apply (intro conjI impI) 

            (* offs *)
             apply (drule(1) invoke_untyped_proofs.idx_le_new_offs) apply simp 

           (* usable untyped range *)
            apply (simp add: shiftL_nat shiftl_t2n overlap_ranges) apply (rule order_trans, erule invoke_untyped_proofs.subset_stuff) apply (simp add: blah word_and_le2) apply (drule invoke_untyped_proofs.usable_range_disjoint) apply (clarsimp simp: field_simps mask_out_sub_mask shiftl_t2n) apply (rule hoare_post_impErr,
               rule whenE_reset_resetUntypedCap_invs_etc[where ptr="ptr && ~~ mask sz"
                   and ptr'=ptr and sz=sz and idx=idx and ui=ui' and dev=dev]) prefer 2 apply simp apply clarsimp apply (simp only: ui') apply (frule(2) invokeUntyped_proofs.intro) apply (clarsimp simp: cte_wp_at_ctes_of
                              invokeUntyped_proofs.caps_no_overlap'
                              invokeUntyped_proofs.ps_no_overlap'
                              invokeUntyped_proofs.descendants_range
                              if_split[where P="\<lambda>v. v \<le> getFreeIndex x y" for x y]
                              empty_descendants_range_in'
                              invs_pspace_aligned' invs_pspace_distinct'
                              invs_ksCurDomain_maxDomain'
                        cong: if_cong) apply (strengthen refl) apply (frule invokeUntyped_proofs.idx_le_new_offs) apply (frule invokeUntyped_proofs.szw) apply (frule invokeUntyped_proofs.descendants_range(2), simp) apply (clarsimp simp: getFreeIndex_def conj_comms shiftL_nat
                              is_aligned_weaken[OF range_cover.funky_aligned]
                              invs_valid_pspace' isCap_simps
                              arg_cong[OF mask_out_sub_mask, where f="\<lambda>y. x - y" for x]
                              field_simps) apply (intro conjI) 
            (* pspace_no_overlap' *)
             apply (cases reset, simp_all)[1] apply (rule order_trans[rotated],
                  erule invokeUntyped_proofs.idx_compare') apply (simp add: shiftl_t2n mult.commute) apply (drule invokeUntyped_proofs.subset_stuff, simp,
             erule order_trans, simp add: blah word_and_le2) apply (auto split: if_split)[1] apply (drule invokeUntyped_proofs.usableRange_disjoint, simp) apply (clarsimp simp only: pred_conj_def invs ui if_apply_def2) apply (strengthen vui) apply (cut_tac vui invs invs') apply (clarsimp simp: cte_wp_at_caps_of_state valid_sched_etcbs) apply (cut_tac vui' invs') apply (clarsimp simp: ui cte_wp_at_ctes_of if_apply_def2 ui') done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. untypinv_relation ui ui' \<Longrightarrow> corres (dc \<oplus> (=)) (einvs and valid_untyped_inv ui and ct_active) (invs' and valid_untyped_inv' ui' and ct_active') (invoke_untyped ui) (invokeUntyped ui') proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x3 x4 x5 x6 x7 x8. \<lbrakk>untypinv_relation ui ui'; ui = Invocations_A.untyped_invocation.Retype x1 x2 x3 x4 x5 x6 x7 x8\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) (einvs and valid_untyped_inv ui and ct_active) (invs' and valid_untyped_inv' ui' and ct_active') (invoke_untyped ui) (invokeUntyped ui') proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x3 x4 x5 x6 x7 x8 s s'. \<lbrakk>untypinv_relation ui ui'; ui = Invocations_A.untyped_invocation.Retype x1 x2 x3 x4 x5 x6 x7 x8; (einvs and valid_untyped_inv ui and ct_active) s; (invs' and valid_untyped_inv' ui' and ct_active') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped ui) (invokeUntyped ui') proof (prove)
goal (1 subgoal):
 1. \<And>a b x2 x3 x4 x5 x6 x7 x8 s s' ao' sz sza idx idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (a, b) x2 x3 x4 (APIType_map2 (Inr ao')) x6 x7 x8; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (a, b) x2 x3 x4 (APIType_map2 (Inr ao')) x6 x7 x8) (Some (cap.UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (a, b)) x2 x3 x4 ao' x6 (map cte_map x7) x8) (Some (capability.UntypedCap x8 (x4 && ~~ mask sza) sza idxa)) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (a, b)) x2 x3 x4 ao' x6 (map cte_map x7) x8\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (a, b) x2 x3 x4 (APIType_map2 (Inr ao')) x6 x7 x8)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (a, b)) x2 x3 x4 ao' x6 (map cte_map x7) x8)) proof (prove)
goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (state)
goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (state)
goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (state)
goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (state)
goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (state)
this:
invs s
ct_active s
valid_list s
valid_sched s
invs' s'
ct_active' s'
(s, s') \<in> state_relation
valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz') sz' idx')) s'

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (state)
this:
ui = Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev
ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) dev

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s proof (prove)
using this:
valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s proof (state)
this:
cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. ptr_base = ptr && ~~ mask sz \<and> sz' = sz \<and> idx' = idx \<and> 2 \<le> sz proof (prove)
using this:
cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s
valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz') sz' idx')) s'
(s, s') \<in> state_relation
invs s
ct_active s
valid_list s
valid_sched s

goal (1 subgoal):
 1. ptr_base = ptr && ~~ mask sz \<and> sz' = sz \<and> idx' = idx \<and> 2 \<le> sz proof (prove)
goal (1 subgoal):
 1. \<And>sza idxa cte. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; (s, s') \<in> state_relation; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map cref) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s') = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> sz' = sz \<and> idx' = idx \<and> 2 \<le> sz proof (prove)
goal (3 subgoals):
 1. \<And>sza idxa cte. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map cref) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s') = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> cte_wp_at' ((=) (?cte53 sza idxa cte)) (?x53 sza idxa cte) s'
 2. \<And>sza idxa cte. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map cref) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s') = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> valid_objs s
 3. \<And>sza idxa cte. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map cref) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s') = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; \<exists>c slot. cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap (?cte53 sza idxa cte)) \<and> ?x53 sza idxa cte = cte_map slot\<rbrakk> \<Longrightarrow> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> sz' = sz \<and> idx' = idx \<and> 2 \<le> sz proof (prove)
goal (2 subgoals):
 1. \<And>sza idxa cte. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map cref) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s') = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>sza idxa cte. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map cref) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s') = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; \<exists>c slot. cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap cte) \<and> cte_map cref = cte_map slot\<rbrakk> \<Longrightarrow> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> sz' = sz \<and> idx' = idx \<and> 2 \<le> sz proof (prove)
goal (1 subgoal):
 1. \<And>sza idxa cte. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map cref) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s') = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; \<exists>c slot. cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap cte) \<and> cte_map cref = cte_map slot\<rbrakk> \<Longrightarrow> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> sz' = sz \<and> idx' = idx \<and> 2 \<le> sz proof (prove)
goal (1 subgoal):
 1. \<And>sza idxa cte c a b. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map (a, b)) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map (a, b)) (ctes_of s') = {}; cte_map (a, b) \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; cte_wp_at ((=) c) (a, b) s; cap_relation c (capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'); cte_map cref = cte_map (a, b)\<rbrakk> \<Longrightarrow> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> sz' = sz \<and> idx' = idx \<and> 2 \<le> sz proof (prove)
goal (6 subgoals):
 1. \<And>sza idxa cte c a b. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map (a, b)) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map (a, b)) (ctes_of s') = {}; cte_map (a, b) \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; cte_wp_at ((=) c) (a, b) s; cap_relation c (capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'); cte_map cref = cte_map (a, b)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) cref (?s62 sza idxa cte c a b)
 2. \<And>sza idxa cte c a b. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map (a, b)) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map (a, b)) (ctes_of s') = {}; cte_map (a, b) \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; cte_wp_at ((=) c) (a, b) s; cap_relation c (capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'); cte_map cref = cte_map (a, b)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) (?s62 sza idxa cte c a b)
 3. \<And>sza idxa cte c a b. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map (a, b)) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map (a, b)) (ctes_of s') = {}; cte_map (a, b) \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; cte_wp_at ((=) c) (a, b) s; cap_relation c (capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'); cte_map cref = cte_map (a, b)\<rbrakk> \<Longrightarrow> valid_objs (?s62 sza idxa cte c a b)
 4. \<And>sza idxa cte c a b. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map (a, b)) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map (a, b)) (ctes_of s') = {}; cte_map (a, b) \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; cte_wp_at ((=) c) (a, b) s; cap_relation c (capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'); cte_map cref = cte_map (a, b)\<rbrakk> \<Longrightarrow> pspace_aligned (?s62 sza idxa cte c a b)
 5. \<And>sza idxa cte c a b. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map (a, b)) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map (a, b)) (ctes_of s') = {}; cte_map (a, b) \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; cte_wp_at ((=) c) (a, b) s; cap_relation c (capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'); cte_map cref = cte_map (a, b)\<rbrakk> \<Longrightarrow> pspace_distinct (?s62 sza idxa cte c a b)
 6. \<And>sza idxa cte c a b. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map (a, b)) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map (a, b)) (ctes_of s') = {}; cte_map (a, b) \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; cte_wp_at ((=) c) (a, b) s; cap_relation c (capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'); cte_map cref = cte_map (a, b); cref = (a, b)\<rbrakk> \<Longrightarrow> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> sz' = sz \<and> idx' = idx \<and> 2 \<le> sz proof (prove)
goal (1 subgoal):
 1. \<And>sza idxa cte c a b. \<lbrakk>cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s; invs s; ct_active s; valid_list s; valid_sched s; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sza) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz' (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map (a, b)) = Some cte; idxa \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; \<not> reset \<and> idx' \<le> unat (ptr && mask sza) \<or> reset \<and> ptr = ptr && ~~ mask sza; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'; ptr_base = ptr && ~~ mask sza; ptr && ~~ mask sz' = ptr && ~~ mask sza; reset \<longrightarrow> descendants_of cref (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map (a, b)) (ctes_of s') = {}; cte_map (a, b) \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); cref \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; cte_wp_at ((=) c) (a, b) s; cap_relation c (capability.UntypedCap dev (ptr && ~~ mask sza) sz' idx'); cte_map cref = cte_map (a, b); cref = (a, b)\<rbrakk> \<Longrightarrow> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> sz' = sz \<and> idx' = idx \<and> 2 \<le> sz proof (prove)
goal (1 subgoal):
 1. \<And>cte a b. \<lbrakk>caps_of_state s (a, b) = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx); invs s; ct_active s; valid_list s; valid_sched s; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map (a, b)) = Some cte; idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map (a, b)) (ctes_of s') = {}; cte_map (a, b) \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); (a, b) \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; cref = (a, b); sz' = sz; idx' = idx\<rbrakk> \<Longrightarrow> 2 \<le> sz proof (prove)
goal (1 subgoal):
 1. \<And>cte a b. \<lbrakk>invs s; ct_active s; valid_list s; valid_sched s; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); range_cover ptr sz (APIType_capBits ao' us) (length slots); ctes_of s' (cte_map (a, b)) = Some cte; idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; reset \<longrightarrow> descendants_of' (cte_map (a, b)) (ctes_of s') = {}; cte_map (a, b) \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; distinct (map cte_map slots); (a, b) \<notin> set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; distinct slots; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; cref = (a, b); sz' = sz; idx' = idx; s \<turnstile> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx\<rbrakk> \<Longrightarrow> 2 \<le> sz proof (prove)
goal:
No subgoals! proof (state)
this:
ptr_base = ptr && ~~ mask sz \<and> sz' = sz \<and> idx' = idx \<and> 2 \<le> sz

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. minUntypedSizeBits \<le> obj_bits_api (APIType_map2 (Inr ao')) us proof (prove)
using this:
valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. minUntypedSizeBits \<le> obj_bits_api (APIType_map2 (Inr ao')) us proof (prove)
goal (1 subgoal):
 1. \<And>sza idxa. \<lbrakk>cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sz) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idxa \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; ptr && ~~ mask sza = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao'))\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> obj_bits_api (APIType_map2 (Inr ao')) us proof (prove)
goal (7 subgoals):
 1. \<And>sza idxa x1. \<lbrakk>cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sz) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idxa \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; ptr && ~~ mask sza = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ao' = APIObjectType x1\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> obj_bits_api (APIType_map2 (Inr ao')) us
 2. \<And>sza idxa. \<lbrakk>cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sz) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idxa \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; ptr && ~~ mask sza = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ao' = SmallPageObject\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> obj_bits_api (APIType_map2 (Inr ao')) us
 3. \<And>sza idxa. \<lbrakk>cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sz) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idxa \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; ptr && ~~ mask sza = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ao' = LargePageObject\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> obj_bits_api (APIType_map2 (Inr ao')) us
 4. \<And>sza idxa. \<lbrakk>cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sz) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idxa \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; ptr && ~~ mask sza = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ao' = SectionObject\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> obj_bits_api (APIType_map2 (Inr ao')) us
 5. \<And>sza idxa. \<lbrakk>cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sz) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idxa \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; ptr && ~~ mask sza = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ao' = SuperSectionObject\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> obj_bits_api (APIType_map2 (Inr ao')) us
 6. \<And>sza idxa. \<lbrakk>cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sz) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idxa \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; ptr && ~~ mask sza = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ao' = PageTableObject\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> obj_bits_api (APIType_map2 (Inr ao')) us
 7. \<And>sza idxa. \<lbrakk>cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sz) sza idxa \<and> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx = c) cref s; range_cover ptr sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idxa \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; ptr && ~~ mask sza = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ao' = PageDirectoryObject\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> obj_bits_api (APIType_map2 (Inr ao')) us proof (prove)
goal:
No subgoals! proof (state)
this:
minUntypedSizeBits \<le> obj_bits_api (APIType_map2 (Inr ao')) us

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) &&& slots \<noteq> [] proof (prove)
using this:
valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) &&& slots \<noteq> [] proof (state)
this:
range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)
slots \<noteq> []

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. distinct (map cte_map slots) proof (prove)
using this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz') sz' idx')) s'

goal (1 subgoal):
 1. distinct (map cte_map slots) proof (state)
this:
distinct (map cte_map slots)

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. ptr && ~~ mask sz = ptr \<Longrightarrow> {ptr + word_of_nat k |k. k < 2 ^ sz} = {ptr..ptr + 2 ^ sz - 1} proof (prove)
using this:
range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)

goal (1 subgoal):
 1. ptr && ~~ mask sz = ptr \<Longrightarrow> {ptr + word_of_nat k |k. k < 2 ^ sz} = {ptr..ptr + 2 ^ sz - 1} proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); is_aligned (ptr && ~~ mask sz) sz\<rbrakk> \<Longrightarrow> {ptr + word_of_nat k |k. k < 2 ^ sz} = {ptr..ptr + 2 ^ sz - 1}
 2. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)\<rbrakk> \<Longrightarrow> is_aligned (ptr && ~~ mask sz) sz proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); is_aligned (ptr && ~~ mask sz) sz\<rbrakk> \<Longrightarrow> is_aligned ptr sz
 2. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); is_aligned (ptr && ~~ mask sz) sz\<rbrakk> \<Longrightarrow> sz \<le> LENGTH(32)
 3. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)\<rbrakk> \<Longrightarrow> is_aligned (ptr && ~~ mask sz) sz proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); is_aligned (ptr && ~~ mask sz) sz\<rbrakk> \<Longrightarrow> sz \<le> LENGTH(32)
 2. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)\<rbrakk> \<Longrightarrow> is_aligned (ptr && ~~ mask sz) sz proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ptr && ~~ mask sz = ptr; is_aligned (ptr && ~~ mask sz) sz; sz < LENGTH(32)\<rbrakk> \<Longrightarrow> sz \<le> LENGTH(32)
 2. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)\<rbrakk> \<Longrightarrow> is_aligned (ptr && ~~ mask sz) sz proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)\<rbrakk> \<Longrightarrow> is_aligned (ptr && ~~ mask sz) sz proof (prove)
goal:
No subgoals! proof (state)
this:
ptr && ~~ mask sz = ptr \<Longrightarrow> {ptr + word_of_nat k |k. k < 2 ^ sz} = {ptr..ptr + 2 ^ sz - 1}

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. ptr && ~~ mask sz = ptr \<Longrightarrow> delete_objects ptr sz = do y <- modify (clear_um {ptr + word_of_nat k |k. k < 2 ^ sz});
modify (detype {ptr && ~~ mask sz..ptr + 2 ^ sz - 1})
od proof (prove)
using this:
range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)

goal (1 subgoal):
 1. ptr && ~~ mask sz = ptr \<Longrightarrow> delete_objects ptr sz = do y <- modify (clear_um {ptr + word_of_nat k |k. k < 2 ^ sz});
modify (detype {ptr && ~~ mask sz..ptr + 2 ^ sz - 1})
od proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)\<rbrakk> \<Longrightarrow> do y <- do_machine_op (mapM_x (\<lambda>p. storeWord p 0) [ptr , ptr + 4 .e. ptr + 2 ^ sz - 1]);
modify (detype {ptr..ptr + 2 ^ sz - 1})
od = do y <- modify (clear_um {ptr..ptr + 2 ^ sz - 1});
modify (detype {ptr..ptr + 2 ^ sz - 1})
od proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); is_aligned (ptr && ~~ mask sz) sz\<rbrakk> \<Longrightarrow> do y <- do_machine_op (mapM_x (\<lambda>p. storeWord p 0) [ptr , ptr + 4 .e. ptr + 2 ^ sz - 1]);
modify (detype {ptr..ptr + 2 ^ sz - 1})
od = do y <- modify (clear_um {ptr..ptr + 2 ^ sz - 1});
modify (detype {ptr..ptr + 2 ^ sz - 1})
od
 2. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)\<rbrakk> \<Longrightarrow> is_aligned (ptr && ~~ mask sz) sz proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)\<rbrakk> \<Longrightarrow> is_aligned (ptr && ~~ mask sz) sz proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ptr && ~~ mask sz = ptr; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)\<rbrakk> \<Longrightarrow> sz \<le> sz proof (prove)
goal:
No subgoals! proof (state)
this:
ptr && ~~ mask sz = ptr \<Longrightarrow> delete_objects ptr sz = do y <- modify (clear_um {ptr + word_of_nat k |k. k < 2 ^ sz});
modify (detype {ptr && ~~ mask sz..ptr + 2 ^ sz - 1})
od

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. word_of_nat (length slots) - 1 < word_of_nat (length slots) proof (prove)
using this:
slots \<noteq> []

goal (1 subgoal):
 1. word_of_nat (length slots) - 1 < word_of_nat (length slots) proof (prove)
using this:
slots \<noteq> []
length slots \<le> length slots \<Longrightarrow> length slots < 2 ^ LENGTH(32)

goal (1 subgoal):
 1. word_of_nat (length slots) - 1 < word_of_nat (length slots) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>slots \<noteq> []; length slots \<le> length slots \<Longrightarrow> length slots < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> word_of_nat (length slots) - 1 < word_of_nat (length slots) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>slots \<noteq> []; length slots \<le> length slots \<Longrightarrow> length slots < 2 ^ LENGTH(32); slots = []\<rbrakk> \<Longrightarrow> word_of_nat (length slots) - 1 < word_of_nat (length slots)
 2. \<And>a list. \<lbrakk>slots \<noteq> []; length slots \<le> length slots \<Longrightarrow> length slots < 2 ^ LENGTH(32); slots = a # list\<rbrakk> \<Longrightarrow> word_of_nat (length slots) - 1 < word_of_nat (length slots) proof (prove)
goal (1 subgoal):
 1. \<And>a b list. \<lbrakk>length list < 4294967295; slots = (a, b) # list\<rbrakk> \<Longrightarrow> word_of_nat (length list) < 1 + word_of_nat (length list) proof (prove)
goal (1 subgoal):
 1. \<And>a b list. \<lbrakk>length list < 4294967295; slots = (a, b) # list\<rbrakk> \<Longrightarrow> word_of_nat (length list) < word_of_nat (length list) + 1 proof (prove)
goal (2 subgoals):
 1. \<And>a b list. \<lbrakk>length list < 4294967295; slots = (a, b) # list\<rbrakk> \<Longrightarrow> word_of_nat (length list) \<noteq> - 1
 2. \<And>a b list. \<lbrakk>length list < 4294967295; slots = (a, b) # list\<rbrakk> \<Longrightarrow> word_of_nat (length list) \<le> word_of_nat (length list) proof (prove)
goal (2 subgoals):
 1. \<And>a b list. \<lbrakk>length list < 4294967295; slots = (a, b) # list\<rbrakk> \<Longrightarrow> word_of_nat (length list) < - 1
 2. \<And>a b list. \<lbrakk>length list < 4294967295; slots = (a, b) # list\<rbrakk> \<Longrightarrow> word_of_nat (length list) \<le> word_of_nat (length list) proof (prove)
goal (2 subgoals):
 1. \<And>a b list. \<lbrakk>length list < 4294967295; slots = (a, b) # list\<rbrakk> \<Longrightarrow> word_of_nat (length list) < 0xFFFFFFFF
 2. \<And>a b list. \<lbrakk>length list < 4294967295; slots = (a, b) # list\<rbrakk> \<Longrightarrow> word_of_nat (length list) \<le> word_of_nat (length list) proof (prove)
goal (2 subgoals):
 1. \<And>a b list. \<lbrakk>length list < 4294967295; slots = (a, b) # list\<rbrakk> \<Longrightarrow> length list < unat 0xFFFFFFFF
 2. \<And>a b list. \<lbrakk>length list < 4294967295; slots = (a, b) # list\<rbrakk> \<Longrightarrow> word_of_nat (length list) \<le> word_of_nat (length list) proof (prove)
goal:
No subgoals! proof (state)
this:
word_of_nat (length slots) - 1 < word_of_nat (length slots)

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. ptr \<noteq> 0 proof (prove)
using this:
cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) cref s
invs s
ct_active s
valid_list s
valid_sched s

goal (1 subgoal):
 1. ptr \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<lbrakk>caps_of_state s cref = Some (cap.UntypedCap dev 0 sz idx); invs s; ct_active s; valid_list s; valid_sched s; ptr = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>caps_of_state s cref = Some (cap.UntypedCap dev 0 sz idx); ct_active s; valid_list s; valid_sched s; ptr = 0; s \<turnstile> cap.UntypedCap dev 0 sz idx\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
ptr \<noteq> 0

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us proof (prove)
goal (7 subgoals):
 1. \<And>x1. ao' = APIObjectType x1 \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 2. ao' = SmallPageObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 3. ao' = LargePageObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 4. ao' = SectionObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 5. ao' = SuperSectionObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 6. ao' = PageTableObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 7. ao' = PageDirectoryObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. ao' = APIObjectType apiobject_type \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 2. ao' = SmallPageObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 3. ao' = LargePageObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 4. ao' = SectionObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 5. ao' = SuperSectionObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 6. ao' = PageTableObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 7. ao' = PageDirectoryObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>ao' = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 2. \<And>apiobject_type. \<lbrakk>ao' = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 3. \<And>apiobject_type. \<lbrakk>ao' = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 4. \<And>apiobject_type. \<lbrakk>ao' = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 5. \<And>apiobject_type. \<lbrakk>ao' = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 6. ao' = SmallPageObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 7. ao' = LargePageObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 8. ao' = SectionObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 9. ao' = SuperSectionObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
 10. ao' = PageTableObject \<Longrightarrow> APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us
A total of 11 subgoals... proof (prove)
goal:
No subgoals! proof (state)
this:
APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. \<not> reset \<Longrightarrow> idx < 2 ^ sz proof (prove)
using this:
valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. \<not> reset \<Longrightarrow> idx < 2 ^ sz proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> reset; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx); range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idx \<le> unat (ptr && mask sz); ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao'))\<rbrakk> \<Longrightarrow> idx < 2 ^ sz proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> reset; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx); range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao'))\<rbrakk> \<Longrightarrow> unat (ptr && mask sz) < 2 ^ sz proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> reset; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx); range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao'))\<rbrakk> \<Longrightarrow> ptr && mask sz < word_of_nat (2 ^ sz) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> reset; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx); range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao'))\<rbrakk> \<Longrightarrow> ptr && mask sz < 2 ^ sz proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> reset; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx); range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao'))\<rbrakk> \<Longrightarrow> sz < LENGTH(32) proof (prove)
using this:
range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)

goal (1 subgoal):
 1. \<lbrakk>\<not> reset; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx); range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao'))\<rbrakk> \<Longrightarrow> sz < LENGTH(32) proof (prove)
goal:
No subgoals! proof (state)
this:
\<not> reset \<Longrightarrow> idx < 2 ^ sz

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (state)
this:
untyped_range (cap.UntypedCap ?dev ?p ?n ?f) = {?p..?p + (1 << ?n) - 1}
untyped_range cap.NullCap = {}
untyped_range (cap.EndpointCap ?r ?badge ?rights) = {}
untyped_range (cap.NotificationCap ?r ?badge ?rights) = {}
untyped_range (cap.CNodeCap ?r ?bits ?guard) = {}
untyped_range (cap.ThreadCap ?r) = {}
untyped_range cap.DomainCap = {}
untyped_range (cap.ReplyCap ?r ?master ?rights) = {}
untyped_range cap.IRQControlCap = {}
untyped_range (cap.IRQHandlerCap ?irq) = {}
untyped_range (cap.Zombie ?r ?b ?n) = {}
untyped_range (cap.ArchObjectCap ?cap) = {}
usable_untyped_range (cap.UntypedCap ?uu ?p ?n ?f) = (if ?f < 2 ^ ?n then {?p + word_of_nat ?f..?p + 2 ^ ?n - 1} else {})
(?i \<in> {?l..?u}) = (?l \<le> ?i \<and> ?i \<le> ?u)
({?a..?b} \<subseteq> {?c..?d}) = (\<not> ?a \<le> ?b \<or> ?c \<le> ?a \<and> ?b \<le> ?d)
(?i \<in> {?l..<?u}) = (?l \<le> ?i \<and> ?i < ?u)
{?a..?b} \<inter> {?c..?d} = {max ?a ?c..min ?b ?d}
({?a..?b} = {}) = (\<not> ?a \<le> ?b)
(\<exists>x. ?P x) = (\<exists>a b. ?P (a, b))
usableUntypedRange (capability.UntypedCap ?d ?p ?n ?f) = (if ?f < 2 ^ ?n then {?p + word_of_nat ?f..?p + 2 ^ ?n - 1} else {})

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. valid_cap' (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx) s' proof (prove)
using this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz') sz' idx')) s'
invs' s'
ct_active' s'

goal (1 subgoal):
 1. valid_cap' (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx) s' proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>invs' s'; ct_active' s'; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s' (cte_map cref) = Some cte; \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz idx; reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s') = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx) s' proof (prove)
goal (1 subgoal):
 1. \<And>cte x1 x2. \<lbrakk>invs' s'; ct_active' s'; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s' (cte_map cref) = Some cte; \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz idx; reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s') = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx) s' proof (prove)
goal (1 subgoal):
 1. \<And>x2. \<lbrakk>invs' s'; ct_active' s'; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s' (cte_map cref) = Some (CTE (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx) x2); \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s') = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx) s' proof (prove)
goal (1 subgoal):
 1. \<And>x2. \<lbrakk>invs' s'; ct_active' s'; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s') = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; sch_act_simple s'; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> valid_objs' s' proof (prove)
goal:
No subgoals! proof (state)
this:
valid_cap' (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx) s'

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - (ptr && ~~ mask sz) = (ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us proof (prove)
goal (1 subgoal):
 1. (ptr && mask sz) + (ptr && ~~ mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - (ptr && ~~ mask sz) = (ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us proof (prove)
goal:
No subgoals! proof (state)
this:
ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - (ptr && ~~ mask sz) = (ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)) \<le> 2 ^ sz proof (prove)
goal (1 subgoal):
 1. unat (ptr && mask sz) + unat (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) \<le> 2 ^ sz proof (prove)
goal (1 subgoal):
 1. unat (ptr && mask sz) + length slots * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us \<le> 2 ^ sz proof (prove)
goal (1 subgoal):
 1. length slots * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us + unat (ptr && mask sz) \<le> 2 ^ sz \<Longrightarrow> unat (ptr && mask sz) + length slots * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us \<le> 2 ^ sz proof (prove)
goal:
No subgoals! proof (state)
this:
unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)) \<le> 2 ^ sz

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz \<Longrightarrow> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1 < ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us proof (prove)
goal (1 subgoal):
 1. unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz \<Longrightarrow> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us \<noteq> 0 proof (prove)
goal (2 subgoals):
 1. unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz \<Longrightarrow> ptr \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us
 2. unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz \<Longrightarrow> ptr \<noteq> 0 proof (prove)
goal (3 subgoals):
 1. unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz \<Longrightarrow> unat (ptr && mask ?sz6) + unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ ?sz6
 2. unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz \<Longrightarrow> ?sz6 < word_bits
 3. unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz \<Longrightarrow> ptr \<noteq> 0 proof (prove)
goal (2 subgoals):
 1. unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz \<Longrightarrow> sz < word_bits
 2. unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz \<Longrightarrow> ptr \<noteq> 0 proof (prove)
goal:
No subgoals! proof (state)
this:
unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz \<Longrightarrow> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1 < ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (state)
this:
(ptr && mask sz) + (ptr && ~~ mask sz) = ptr

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz; ptr && ~~ mask sz = ptr\<rbrakk> \<Longrightarrow> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1 < ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us proof (prove)
goal (1 subgoal):
 1. \<lbrakk>unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz; ptr && ~~ mask sz = ptr\<rbrakk> \<Longrightarrow> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<lbrakk>unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz; is_aligned ptr sz\<rbrakk> \<Longrightarrow> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us \<noteq> 0 proof (prove)
goal (2 subgoals):
 1. \<lbrakk>unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz; is_aligned ptr sz\<rbrakk> \<Longrightarrow> ptr \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us
 2. \<lbrakk>unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz; is_aligned ptr sz\<rbrakk> \<Longrightarrow> ptr \<noteq> 0 proof (prove)
goal (3 subgoals):
 1. \<lbrakk>unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz; is_aligned ptr sz\<rbrakk> \<Longrightarrow> unat (ptr && mask sz) + unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz
 2. \<lbrakk>unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz; is_aligned ptr sz\<rbrakk> \<Longrightarrow> sz < word_bits
 3. \<lbrakk>unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz; is_aligned ptr sz\<rbrakk> \<Longrightarrow> ptr \<noteq> 0 proof (prove)
goal (2 subgoals):
 1. \<lbrakk>unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz; ptr && mask sz = 0\<rbrakk> \<Longrightarrow> sz < word_bits
 2. \<lbrakk>unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz; is_aligned ptr sz\<rbrakk> \<Longrightarrow> ptr \<noteq> 0 proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>unat (word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz; ptr && ~~ mask sz = ptr\<rbrakk> \<Longrightarrow> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1 < ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. ksCurDomain s' \<le> maxDomain proof (prove)
using this:
invs' s'
ct_active' s'

goal (1 subgoal):
 1. ksCurDomain s' \<le> maxDomain proof (state)
this:
ksCurDomain s' \<le> maxDomain

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. unat (ptr && mask sz) < 2 ^ sz proof (prove)
using this:
sz < LENGTH(32)
obj_bits_api (APIType_map2 (Inr ao')) us \<le> sz
length slots + unat (ptr && mask sz >> obj_bits_api (APIType_map2 (Inr ao')) us) \<le> 2 ^ (sz - obj_bits_api (APIType_map2 (Inr ao')) us)

goal (1 subgoal):
 1. unat (ptr && mask sz) < 2 ^ sz proof (state)
this:
unat (ptr && mask sz) < 2 ^ sz

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. {x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * word_of_nat (length slots) - 1} \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (2 subgoals):
 1. ?y \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. {x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * word_of_nat (length slots) - 1} \<subseteq> ?y proof (prove)
goal (1 subgoal):
 1. {x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * word_of_nat (length slots) - 1} \<subseteq> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} proof (prove)
goal:
No subgoals! proof (state)
this:
{x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * word_of_nat (length slots) - 1} \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. idx \<le> unat (ptr && mask sz) \<Longrightarrow> {x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * word_of_nat (length slots) - 1} \<subseteq> {(ptr && ~~ mask sz) + word_of_nat idx..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (1 subgoal):
 1. idx \<le> unat (ptr && mask sz) \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {(ptr && ~~ mask sz) + word_of_nat idx..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>idx \<le> unat (ptr && mask sz); ptr \<le> (ptr && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> (ptr && ~~ mask sz) + word_of_nat idx \<le> ptr proof (prove)
goal (3 subgoals):
 1. \<lbrakk>idx \<le> unat (ptr && mask sz); ptr \<le> (ptr && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> word_of_nat idx \<le> ?z6
 2. \<lbrakk>idx \<le> unat (ptr && mask sz); ptr \<le> (ptr && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> ptr && ~~ mask sz \<le> (ptr && ~~ mask sz) + ?z6
 3. \<lbrakk>idx \<le> unat (ptr && mask sz); ptr \<le> (ptr && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> (ptr && ~~ mask sz) + ?z6 \<le> ptr proof (prove)
goal (2 subgoals):
 1. \<lbrakk>idx \<le> unat (ptr && mask sz); ptr \<le> (ptr && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> ptr && ~~ mask sz \<le> (ptr && ~~ mask sz) + (ptr && mask sz)
 2. \<lbrakk>idx \<le> unat (ptr && mask sz); ptr \<le> (ptr && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> (ptr && ~~ mask sz) + (ptr && mask sz) \<le> ptr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>idx \<le> unat (ptr && mask sz); ptr \<le> (ptr && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> (ptr && ~~ mask sz) + (ptr && mask sz) \<le> ptr proof (prove)
goal:
No subgoals! proof (state)
this:
idx \<le> unat (ptr && mask sz) \<Longrightarrow> {x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * word_of_nat (length slots) - 1} \<subseteq> {(ptr && ~~ mask sz) + word_of_nat idx..(ptr && ~~ mask sz) + 2 ^ sz - 1}

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. {x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * word_of_nat (length slots) - 1} \<subseteq> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) proof (prove)
goal (2 subgoals):
 1. reset \<Longrightarrow> {x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * word_of_nat (length slots) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<not> reset \<Longrightarrow> {x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * word_of_nat (length slots) - 1} \<subseteq> {(ptr && ~~ mask sz) + word_of_nat idx..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (2 subgoals):
 1. reset \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<not> reset \<Longrightarrow> {x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * word_of_nat (length slots) - 1} \<subseteq> {(ptr && ~~ mask sz) + word_of_nat idx..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (1 subgoal):
 1. \<not> reset \<Longrightarrow> {x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * word_of_nat (length slots) - 1} \<subseteq> {(ptr && ~~ mask sz) + word_of_nat idx..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (1 subgoal):
 1. \<not> reset \<Longrightarrow> idx \<le> unat (ptr && mask sz) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> reset; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> idx \<le> unat (ptr && mask sz) proof (prove)
goal:
No subgoals! proof (state)
this:
{x. ptr \<le> x \<and> x \<le> ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * word_of_nat (length slots) - 1} \<subseteq> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (state)
this:
\<lbrace>\<lambda>s. (if reset then 0 else idx) \<le> ?idx \<and> ?idx \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) ?cref s\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx) ?cref \<lbrace>\<lambda>rv. invs\<rbrace>

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (state)
this:
(ptr && mask sz) + (ptr && ~~ mask sz) = ptr

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (state)
this:
?P (if ?Q then ?x else ?y) = ((?Q \<longrightarrow> ?P ?x) \<and> (\<not> ?Q \<longrightarrow> ?P ?y))

goal (1 subgoal):
 1. \<And>cref oref reset ptr ptr' dca us slots dev s s' ao' sz sz' idx idx'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev; (s, s') \<in> state_relation; ct_active s; ct_active' s'; invs' s'; valid_sched s; invs s; valid_list s; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr' && ~~ mask sz') sz' idx')) s'; ui' = Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype (cref, oref) reset ptr ptr' (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map (cref, oref)) reset ptr ptr' ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) dev)) proof (prove)
goal (1 subgoal):
 1. corres (dc \<oplus> (=)) ((=) s) ((=) s') (doE y <- whenE reset (reset_untyped_cap cref);
liftE (do cap <- get_cap cref;
y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od)
odE) (doE y <- whenE reset (resetUntypedCap (cte_map cref));
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)) [];
y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od)
odE) proof (prove)
goal (1 subgoal):
 1. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> corres (dc \<oplus> (=)) ((=) s) ((=) s') (doE y <- whenE reset (reset_untyped_cap cref);
liftE (do cap <- get_cap cref;
y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od)
odE) (doE y <- whenE reset (resetUntypedCap (cte_map cref));
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)) [];
y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od)
odE) proof (prove)
goal (3 subgoals):
 1. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> corres (dc \<oplus> (=)) ?Q3 ?Q'3 (doE y <- whenE reset (reset_untyped_cap cref);
liftE (do cap <- get_cap cref;
y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od)
odE) (doE y <- whenE reset (resetUntypedCap (cte_map cref));
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)) [];
y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od)
odE)
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ?Q3 sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ?Q'3 s proof (prove)
goal (6 subgoals):
 1. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> corres (dc \<oplus> dc) ?P7 ?P'7 (whenE reset (reset_untyped_cap cref)) (whenE reset (resetUntypedCap (cte_map cref)))
 2. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> corres (dc \<oplus> (=)) ?R7 ?R'7 (liftE (do cap <- get_cap cref;
y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od)) (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)) [];
y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od))
 3. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x. ?R7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. ?R'7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> (?P7 and ?Q7) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> (?P'7 and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> corres (dc \<oplus> dc) ?P12 ?P'12 (reset_untyped_cap cref) (resetUntypedCap (cte_map cref))
 2. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> dc () ()
 3. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> corres (dc \<oplus> (=)) ?R7 ?R'7 (liftE (do cap <- get_cap cref;
y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od)) (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)) [];
y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od))
 4. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x. ?R7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. ?R'7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> ?P12 s) and ?Q7) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> ?P'12 s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> untypinv_relation ui ui'
 2. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> dc () ()
 3. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> corres (dc \<oplus> (=)) ?R7 ?R'7 (liftE (do cap <- get_cap cref;
y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od)) (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)) [];
y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od))
 4. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x. ?R7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. ?R'7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (6 subgoals):
 1. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> dc () ()
 2. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> corres (dc \<oplus> (=)) ?R7 ?R'7 (liftE (do cap <- get_cap cref;
y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od)) (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)) [];
y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od))
 3. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x. ?R7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. ?R'7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> corres (dc \<oplus> (=)) ?R7 ?R'7 (liftE (do cap <- get_cap cref;
y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od)) (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)) [];
y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od))
 2. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x. ?R7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. ?R'7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> corres (=) ?R7 ?R'7 (do cap <- get_cap cref;
y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od) (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)) [];
y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od)
 2. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x. ?R7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. ?R'7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<And>cap. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> corres (=) (?Q18 cap) ?R'7 (do y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od) (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)) [];
y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od)
 2. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ?Q18 rv s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. ?R'7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\<rbrakk> \<Longrightarrow> corres (=) (?P20 cap) ?R'7 (do y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od) (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)) [];
y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od)
 2. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. (?P20 rv and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. ?R'7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\<rbrakk> \<Longrightarrow> corres (=) (?P20 cap) ?R'7 (do _ <- return ();
y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od) (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)) [];
y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od)
 2. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. (?P20 rv and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. ?R'7\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\<rbrakk> \<Longrightarrow> corres (=) (?R23 cap) ?R'30 (do y <- set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref;
orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od) (do y <- updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))));
createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev
od)
 2. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and ?R23 rv and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> ?R'30 s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (9 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\<rbrakk> \<Longrightarrow> is_untyped_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\<rbrakk> \<Longrightarrow> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))
 3. \<And>cap y ya. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya\<rbrakk> \<Longrightarrow> corres (=) (?R32 cap y) (?R'32 cap ya) (do orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od) (createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev)
 4. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>?R32 cap\<rbrace>
 5. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>?R'32 cap\<rbrace>
 6. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 9. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (8 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\<rbrakk> \<Longrightarrow> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))
 2. \<And>cap y ya. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya\<rbrakk> \<Longrightarrow> corres (=) (?R32 cap y) (?R'32 cap ya) (do orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od) (createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev)
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>?R32 cap\<rbrace>
 4. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>?R'32 cap\<rbrace>
 5. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 8. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>cap y ya. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya\<rbrakk> \<Longrightarrow> corres (=) (?R32 cap y) (?R'32 cap ya) (do orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od) (createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev)
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>?R32 cap\<rbrace>
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>?R'32 cap\<rbrace>
 4. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>cap y ya. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> corres (=) (?R32 cap y) (?R'32 cap ya) (do orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od) (createNewObjects ao' (cte_map cref) (map cte_map slots) ptr us dev)
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>?R32 cap\<rbrace>
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>?R'32 cap\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (12 subgoals):
 1. \<And>cap y ya. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> distinct (map cte_map slots)
 2. \<And>cap y ya. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> range_cover ptr (?sz76 cap y ya) (getObjectSize ao' us) (length (map cte_map slots))
 3. \<And>cap y ya. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 4. \<And>cap y ya. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> length (map cte_map slots) \<noteq> 0
 5. \<And>cap y ya. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> corres (=) (?R32 cap y) (?R'32 cap ya) (do orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od) (insertNewCaps ao' (cte_map cref) (map cte_map slots) ptr us dev)
 6. \<And>cap y ya s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; ?R'32 cap ya s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) (cte_map cref) s \<and> (\<forall>slot\<in>set (map cte_map slots). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> pspace_no_overlap' ptr (?sz76 cap y ya) s \<and> caps_no_overlap'' ptr (?sz76 cap y ya) s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length (map cte_map slots)) * 2 ^ getObjectSize ao' us - 1} s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> ksCurDomain s \<le> maxDomain
 7. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>?R32 cap\<rbrace>
 8. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>?R'32 cap\<rbrace>
 9. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> corres (=) (?R32 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()) (?R'32 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()) (do orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od) (insertNewCaps ao' (cte_map cref) (map cte_map slots) ptr us dev)
 2. \<And>cap y ya s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; ?R'32 cap ya s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) (cte_map cref) s \<and> (\<forall>slot\<in>set (map cte_map slots). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length (map cte_map slots)) * 2 ^ getObjectSize ao' us - 1} s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> ksCurDomain s \<le> maxDomain
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>?R32 cap\<rbrace>
 4. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>?R'32 cap\<rbrace>
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 8. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (8 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> corres (=) (?R32 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()) (?R'32 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()) (do orefs <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
y <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us orefs;
sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots orefs))
od) (createNewCaps ao' ptr (length slots) us dev >>= zipWithM_x (insertNewCap (cte_map cref)) (map cte_map slots))
 2. \<And>cap y ya s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; ?R'32 cap ya s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) (cte_map cref) s \<and> (\<forall>slot\<in>set (map cte_map slots). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length (map cte_map slots)) * 2 ^ getObjectSize ao' us - 1} s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> ksCurDomain s \<le> maxDomain
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>?R32 cap\<rbrace>
 4. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>?R'32 cap\<rbrace>
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 8. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (11 subgoals):
 1. \<And>cap rv caps. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; length rv = length caps \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr ao')) ref us dev) rv) caps\<rbrakk> \<Longrightarrow> corres (?r'84 cap rv caps) (?R83 cap rv) (?R'83 cap caps) (sequence_x (map (create_cap (APIType_map2 (Inr ao')) us cref dev) (zip slots rv))) (zipWithM_x (insertNewCap (cte_map cref)) (map cte_map slots) caps)
 2. \<And>cap rv caps y ya. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; length rv = length caps \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr ao')) ref us dev) rv) caps; ?r'84 cap rv caps y ya\<rbrakk> \<Longrightarrow> y = ya
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q89 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()\<rbrace> do y <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
ya <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us y;
return y
od \<lbrace>?R83 cap\<rbrace>
 4. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'87 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()\<rbrace> createNewCaps ao' ptr (length slots) us dev \<lbrace>?R'83 cap\<rbrace>
 5. \<And>cap y ya s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and ?Q'87 cap ya) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) (cte_map cref) s \<and> (\<forall>slot\<in>set (map cte_map slots). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length (map cte_map slots)) * 2 ^ getObjectSize ao' us - 1} s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> ksCurDomain s \<le> maxDomain
 6. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) and ?Q89 cap a\<rbrace>
 7. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and ?Q'87 cap a\<rbrace>
 8. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap rv caps. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; length rv = length caps \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr ao')) ref us dev) rv) caps\<rbrakk> \<Longrightarrow> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr ao')) ref us dev) rv) caps
 2. \<And>cap rv caps y ya. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; length rv = length caps \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr ao')) ref us dev) rv) caps; dc y ya\<rbrakk> \<Longrightarrow> y = ya
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q89 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()\<rbrace> do y <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
ya <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us y;
return y
od \<lbrace>\<lambda>rv s. pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_mdb s \<and> valid_list s \<and> cte_wp_at is_untyped_cap cref s \<and> (\<forall>tup\<in>set (zip slots rv). cte_wp_at (\<lambda>c. cap_range (default_cap (APIType_map2 (Inr ao')) (snd tup) us dev) \<subseteq> untyped_range c) cref s) \<and> (\<forall>tup\<in>set (zip slots rv). descendants_range (default_cap (APIType_map2 (Inr ao')) (snd tup) us dev) cref s) \<and> (\<forall>tup\<in>set (zip slots rv). caps_overlap_reserved (untyped_range (default_cap (APIType_map2 (Inr ao')) (snd tup) us dev)) s) \<and> (\<forall>tup\<in>set (zip slots rv). real_cte_at (fst tup) s) \<and> (\<forall>tup\<in>set (zip slots rv). cte_wp_at ((=) cap.NullCap) (fst tup) s) \<and> distinct (cref # map fst (zip slots rv)) \<and> distinct_sets (map (\<lambda>tup. cap_range (default_cap (APIType_map2 (Inr ao')) (snd tup) us dev)) (zip slots rv)) \<and> (\<forall>tup\<in>set (zip slots rv). s \<turnstile> default_cap (APIType_map2 (Inr ao')) (snd tup) us dev)\<rbrace>
 4. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'87 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()\<rbrace> createNewCaps ao' ptr (length slots) us dev \<lbrace>\<lambda>caps s. (\<forall>tup\<in>set (zip (map cte_map slots) caps). valid_cap' (snd tup) s) \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (fst tup) s) \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). global.sameRegionAs (cteCap cte) (snd tup))) (cte_map cref) s \<and> distinct (cte_map cref # map fst (zip (map cte_map slots) caps)) \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). descendants_range' (snd tup) (cte_map cref) (ctes_of s)) \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). caps_overlap_reserved' (capRange (snd tup)) s) \<and> distinct_sets (map capRange (map snd (zip (map cte_map slots) caps)))\<rbrace>
 5. \<And>cap y ya s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and ?Q'87 cap ya) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) (cte_map cref) s \<and> (\<forall>slot\<in>set (map cte_map slots). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length (map cte_map slots)) * 2 ^ getObjectSize ao' us - 1} s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> ksCurDomain s \<le> maxDomain
 6. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) and ?Q89 cap a\<rbrace>
 7. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and ?Q'87 cap a\<rbrace>
 8. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>cap rv caps y ya. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; length rv = length caps \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr ao')) ref us dev) rv) caps; dc y ya\<rbrakk> \<Longrightarrow> y = ya
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q89 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()\<rbrace> do y <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
ya <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us y;
return y
od \<lbrace>\<lambda>rv s. pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_mdb s \<and> valid_list s \<and> cte_wp_at is_untyped_cap cref s \<and> (\<forall>tup\<in>set (zip slots rv). cte_wp_at (\<lambda>c. cap_range (default_cap (APIType_map2 (Inr ao')) (snd tup) us dev) \<subseteq> untyped_range c) cref s) \<and> (\<forall>tup\<in>set (zip slots rv). descendants_range (default_cap (APIType_map2 (Inr ao')) (snd tup) us dev) cref s) \<and> (\<forall>tup\<in>set (zip slots rv). caps_overlap_reserved (untyped_range (default_cap (APIType_map2 (Inr ao')) (snd tup) us dev)) s) \<and> (\<forall>tup\<in>set (zip slots rv). real_cte_at (fst tup) s) \<and> (\<forall>tup\<in>set (zip slots rv). cte_wp_at ((=) cap.NullCap) (fst tup) s) \<and> distinct (cref # map fst (zip slots rv)) \<and> distinct_sets (map (\<lambda>tup. cap_range (default_cap (APIType_map2 (Inr ao')) (snd tup) us dev)) (zip slots rv)) \<and> (\<forall>tup\<in>set (zip slots rv). s \<turnstile> default_cap (APIType_map2 (Inr ao')) (snd tup) us dev)\<rbrace>
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'87 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()\<rbrace> createNewCaps ao' ptr (length slots) us dev \<lbrace>\<lambda>caps s. (\<forall>tup\<in>set (zip (map cte_map slots) caps). valid_cap' (snd tup) s) \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (fst tup) s) \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). global.sameRegionAs (cteCap cte) (snd tup))) (cte_map cref) s \<and> distinct (cte_map cref # map fst (zip (map cte_map slots) caps)) \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). descendants_range' (snd tup) (cte_map cref) (ctes_of s)) \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). caps_overlap_reserved' (capRange (snd tup)) s) \<and> distinct_sets (map capRange (map snd (zip (map cte_map slots) caps)))\<rbrace>
 4. \<And>cap y ya s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and ?Q'87 cap ya) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) (cte_map cref) s \<and> (\<forall>slot\<in>set (map cte_map slots). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length (map cte_map slots)) * 2 ^ getObjectSize ao' us - 1} s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> ksCurDomain s \<le> maxDomain
 5. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) and ?Q89 cap a\<rbrace>
 6. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and ?Q'87 cap a\<rbrace>
 7. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 10. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (9 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q89 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()\<rbrace> do y <- retype_region ptr (length slots) us (APIType_map2 (Inr ao')) dev;
ya <- init_arch_objects (APIType_map2 (Inr ao')) ptr (length slots) us y;
return y
od \<lbrace>\<lambda>rv s. pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_mdb s \<and> valid_list s \<and> cte_wp_at is_untyped_cap cref s \<and> (\<forall>tup\<in>set (zip slots rv). cte_wp_at (\<lambda>c. cap_range (default_cap (APIType_map2 (Inr ao')) (snd tup) us dev) \<subseteq> untyped_range c) cref s) \<and> (\<forall>tup\<in>set (zip slots rv). descendants_range (default_cap (APIType_map2 (Inr ao')) (snd tup) us dev) cref s) \<and> (\<forall>tup\<in>set (zip slots rv). caps_overlap_reserved (untyped_range (default_cap (APIType_map2 (Inr ao')) (snd tup) us dev)) s) \<and> (\<forall>tup\<in>set (zip slots rv). real_cte_at (fst tup) s) \<and> (\<forall>tup\<in>set (zip slots rv). cte_wp_at ((=) cap.NullCap) (fst tup) s) \<and> distinct (cref # map fst (zip slots rv)) \<and> distinct_sets (map (\<lambda>tup. cap_range (default_cap (APIType_map2 (Inr ao')) (snd tup) us dev)) (zip slots rv)) \<and> (\<forall>tup\<in>set (zip slots rv). s \<turnstile> default_cap (APIType_map2 (Inr ao')) (snd tup) us dev)\<rbrace>
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'87 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()\<rbrace> createNewCaps ao' ptr (length slots) us dev \<lbrace>\<lambda>caps s. (\<forall>tup\<in>set (zip (map cte_map slots) caps). valid_cap' (snd tup) s) \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (fst tup) s) \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). global.sameRegionAs (cteCap cte) (snd tup))) (cte_map cref) s \<and> distinct (cte_map cref # map fst (zip (map cte_map slots) caps)) \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). descendants_range' (snd tup) (cte_map cref) (ctes_of s)) \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). caps_overlap_reserved' (capRange (snd tup)) s) \<and> distinct_sets (map capRange (map snd (zip (map cte_map slots) caps)))\<rbrace>
 3. \<And>cap y ya s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and ?Q'87 cap ya) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) (cte_map cref) s \<and> (\<forall>slot\<in>set (map cte_map slots). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length (map cte_map slots)) * 2 ^ getObjectSize ao' us - 1} s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> ksCurDomain s \<le> maxDomain
 4. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) and ?Q89 cap a\<rbrace>
 5. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and ?Q'87 cap a\<rbrace>
 6. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 9. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (8 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'87 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()\<rbrace> createNewCaps ao' ptr (length slots) us dev \<lbrace>\<lambda>caps s. (\<forall>tup\<in>set (zip (map cte_map slots) caps). valid_cap' (snd tup) s) \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (fst tup) s) \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). global.sameRegionAs (cteCap cte) (snd tup))) (cte_map cref) s \<and> distinct (cte_map cref # map fst (zip (map cte_map slots) caps)) \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). descendants_range' (snd tup) (cte_map cref) (ctes_of s)) \<and> (\<forall>tup\<in>set (zip (map cte_map slots) caps). caps_overlap_reserved' (capRange (snd tup)) s) \<and> distinct_sets (map capRange (map snd (zip (map cte_map slots) caps)))\<rbrace>
 2. \<And>cap y ya s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and ?Q'87 cap ya) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) (cte_map cref) s \<and> (\<forall>slot\<in>set (map cte_map slots). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length (map cte_map slots)) * 2 ^ getObjectSize ao' us - 1} s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> ksCurDomain s \<le> maxDomain
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) and (\<lambda>a. (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> valid_list a \<and> (pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at is_untyped_cap cref a \<and> valid_pspace a) \<and> (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) cref and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> valid_pspace a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref a) \<and> (valid_pspace and valid_mdb and caps_no_overlap ptr sz and pspace_no_overlap (up_aligned_area ptr sz) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> real_cte_at x a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> valid_objs a \<and> pspace_aligned a) \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at ((=) cap.NullCap) x a \<and> valid_pspace a) \<and> distinct (cref # slots) \<and> K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)) a \<and> (pspace_no_overlap (up_aligned_area ptr sz) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) and K (APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> ptr \<noteq> 0)) a)\<rbrace>
 4. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and ?Q'87 cap a\<rbrace>
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 8. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>cap y ya s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); dc y ya; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>a. (pspace_no_overlap' ptr sz a \<and> valid_pspace' a \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x a \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap ya)) (cte_map cref) a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz a \<and> valid_pspace' a \<and> caps_no_overlap'' ptr sz a \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} a \<and> ksCurDomain a \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz a \<and> valid_pspace' a \<and> caps_no_overlap'' ptr sz a \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} a \<and> ksCurDomain a \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz a \<and> valid_pspace' a \<and> caps_no_overlap'' ptr sz a \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} a \<and> ksCurDomain a \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz a \<and> valid_pspace' a \<and> caps_no_overlap'' ptr sz a \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} a \<and> ksCurDomain a \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of a)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) (cte_map cref) s \<and> (\<forall>slot\<in>set (map cte_map slots). cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length (map cte_map slots)) * 2 ^ getObjectSize ao' us - 1} s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> ksCurDomain s \<le> maxDomain
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) and (\<lambda>a. (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> valid_list a \<and> (pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at is_untyped_cap cref a \<and> valid_pspace a) \<and> (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) cref and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> valid_pspace a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref a) \<and> (valid_pspace and valid_mdb and caps_no_overlap ptr sz and pspace_no_overlap (up_aligned_area ptr sz) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> real_cte_at x a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> valid_objs a \<and> pspace_aligned a) \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at ((=) cap.NullCap) x a \<and> valid_pspace a) \<and> distinct (cref # slots) \<and> K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)) a \<and> (pspace_no_overlap (up_aligned_area ptr sz) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) and K (APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> ptr \<noteq> 0)) a)\<rbrace>
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_arch_state' s; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map x) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; cte_map cref \<notin> cte_map ` set slots; valid_pspace' s; caps_no_overlap'' ptr sz s; ksCurDomain s \<le> maxDomain; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s); caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr sz s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) (cte_map cref) s
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) and (\<lambda>a. (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> valid_list a \<and> (pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at is_untyped_cap cref a \<and> valid_pspace a) \<and> (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) cref and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> valid_pspace a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref a) \<and> (valid_pspace and valid_mdb and caps_no_overlap ptr sz and pspace_no_overlap (up_aligned_area ptr sz) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> real_cte_at x a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> valid_objs a \<and> pspace_aligned a) \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at ((=) cap.NullCap) x a \<and> valid_pspace a) \<and> distinct (cref # slots) \<and> K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)) a \<and> (pspace_no_overlap (up_aligned_area ptr sz) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) and K (APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> ptr \<noteq> 0)) a)\<rbrace>
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>s c. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_arch_state' s; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map x) s; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; cte_map cref \<notin> cte_map ` set slots; valid_pspace' s; caps_no_overlap'' ptr sz s; ksCurDomain s \<le> maxDomain; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s); caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr sz s; cteCap c = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap c)
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) and (\<lambda>a. (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> valid_list a \<and> (pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at is_untyped_cap cref a \<and> valid_pspace a) \<and> (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) cref and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> valid_pspace a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref a) \<and> (valid_pspace and valid_mdb and caps_no_overlap ptr sz and pspace_no_overlap (up_aligned_area ptr sz) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> real_cte_at x a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> valid_objs a \<and> pspace_aligned a) \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at ((=) cap.NullCap) x a \<and> valid_pspace a) \<and> distinct (cref # slots) \<and> K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)) a \<and> (pspace_no_overlap (up_aligned_area ptr sz) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) and K (APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> ptr \<noteq> 0)) a)\<rbrace>
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>s c x1 x2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_arch_state' s; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map x) s; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; cte_map cref \<notin> cte_map ` set slots; valid_pspace' s; caps_no_overlap'' ptr sz s; ksCurDomain s \<le> maxDomain; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s); caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr sz s; x1 = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()); c = CTE x1 x2\<rbrakk> \<Longrightarrow> isUntypedCap x1
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) and (\<lambda>a. (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> valid_list a \<and> (pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at is_untyped_cap cref a \<and> valid_pspace a) \<and> (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) cref and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> valid_pspace a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref a) \<and> (valid_pspace and valid_mdb and caps_no_overlap ptr sz and pspace_no_overlap (up_aligned_area ptr sz) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> real_cte_at x a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> valid_objs a \<and> pspace_aligned a) \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at ((=) cap.NullCap) x a \<and> valid_pspace a) \<and> distinct (cref # slots) \<and> K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)) a \<and> (pspace_no_overlap (up_aligned_area ptr sz) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) and K (APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> ptr \<noteq> 0)) a)\<rbrace>
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>s c x1 x2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_arch_state' s; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map x) s; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; cte_map cref \<notin> cte_map ` set slots; valid_pspace' s; caps_no_overlap'' ptr sz s; ksCurDomain s \<le> maxDomain; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s); caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr sz s\<rbrakk> \<Longrightarrow> isUntypedCap (capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()))
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) and (\<lambda>a. (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> valid_list a \<and> (pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at is_untyped_cap cref a \<and> valid_pspace a) \<and> (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) cref and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> valid_pspace a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref a) \<and> (valid_pspace and valid_mdb and caps_no_overlap ptr sz and pspace_no_overlap (up_aligned_area ptr sz) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> real_cte_at x a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> valid_objs a \<and> pspace_aligned a) \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at ((=) cap.NullCap) x a \<and> valid_pspace a) \<and> distinct (cref # slots) \<and> K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)) a \<and> (pspace_no_overlap (up_aligned_area ptr sz) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) and K (APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> ptr \<noteq> 0)) a)\<rbrace>
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 cap\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) and (\<lambda>a. (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (invs and pspace_no_overlap (up_aligned_area ptr sz) and caps_no_overlap ptr sz and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> valid_list a \<and> (pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at is_untyped_cap cref a \<and> valid_pspace a) \<and> (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) cref and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> valid_pspace a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref a) \<and> (valid_pspace and valid_mdb and caps_no_overlap ptr sz and pspace_no_overlap (up_aligned_area ptr sz) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots))) a \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> real_cte_at x a \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> valid_objs a \<and> pspace_aligned a) \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) a \<and> cte_wp_at ((=) cap.NullCap) x a \<and> valid_pspace a) \<and> distinct (cref # slots) \<and> K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)) a \<and> (pspace_no_overlap (up_aligned_area ptr sz) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) and K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) and K (APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj) and K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> ptr \<noteq> 0)) a)\<rbrace>
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a b. valid_pspace b \<and> valid_mdb b \<and> valid_etcbs b \<and> valid_list b \<and> valid_arch_state b \<and> caps_no_overlap ptr sz b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} b \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot b) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> invs b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> caps_no_overlap ptr sz b \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} b \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} b \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot b) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> invs b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> caps_no_overlap ptr sz b \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} b \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} b \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot b) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> invs b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> caps_no_overlap ptr sz b \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} b \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} b \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot b) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> invs b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> caps_no_overlap ptr sz b \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} b \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} b \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot b) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> valid_list b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at (\<lambda>a. \<exists>dev r bits f. a = cap.UntypedCap dev r bits f) cref b \<and> valid_pspace b \<and> cte_wp_at (\<lambda>c. (\<exists>dev r bits f. c = cap.UntypedCap dev r bits f) \<and> cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz) cref b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> valid_pspace b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> valid_pspace b \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref b \<and> valid_pspace b \<and> valid_mdb b \<and> caps_no_overlap ptr sz b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} b \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot b) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) b \<and> real_cte_at x b \<and> valid_objs b \<and> pspace_aligned b) \<and> (\<forall>x\<in>set slots. pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at ((=) cap.NullCap) x b \<and> valid_pspace b) \<and> cref \<notin> set slots \<and> distinct slots \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj\<rbrace>
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a b. valid_arch_state b \<and> invs b \<and> valid_mdb b \<and> valid_pspace b \<and> distinct slots \<and> caps_no_overlap ptr sz b \<and> cref \<notin> set slots \<and> valid_etcbs b \<and> valid_list b \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at (\<lambda>a. \<exists>dev r bits f. a = cap.UntypedCap dev r bits f) cref b \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} b \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref b \<and> (\<exists>slot. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) slot b) \<and> (\<forall>x\<in>set slots. valid_pspace b \<and> cte_wp_at ((=) cap.NullCap) x b \<and> pspace_no_overlap (up_aligned_area ptr sz) b) \<and> cte_wp_at (\<lambda>c. cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz \<and> (\<exists>dev r bits f. c = cap.UntypedCap dev r bits f)) cref b \<and> (\<forall>x\<in>set slots. pspace_aligned b \<and> valid_objs b \<and> real_cte_at x b \<and> pspace_no_overlap (up_aligned_area ptr sz) b)\<rbrace>
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. invs s \<and> invs s \<and> invs s \<and> invs s \<and> distinct slots \<and> caps_no_overlap ptr sz s \<and> cref \<notin> set slots \<and> valid_etcbs s \<and> valid_list s \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (\<exists>x. caps_of_state s cref = Some x \<and> invs s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>a. \<exists>dev r bits f. a = cap.UntypedCap dev r bits f) cref s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) slot s) \<and> (\<forall>x\<in>set slots. invs s \<and> cte_wp_at ((=) cap.NullCap) x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s) \<and> cte_wp_at (\<lambda>c. cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz \<and> (\<exists>dev r bits f. c = cap.UntypedCap dev r bits f)) cref s \<and> (\<forall>x\<in>set slots. invs s \<and> invs s \<and> real_cte_at x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s)\<rbrace>
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. invs s \<and> distinct slots \<and> caps_no_overlap ptr sz s \<and> cref \<notin> set slots \<and> valid_etcbs s \<and> valid_list s \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>a. \<exists>dev r bits f. a = cap.UntypedCap dev r bits f) cref s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (\<exists>x. caps_of_state s cref = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> (\<exists>slot. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) slot s) \<and> (\<forall>x\<in>set slots. invs s \<and> cte_wp_at ((=) cap.NullCap) x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s) \<and> cte_wp_at (\<lambda>c. cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz \<and> (\<exists>dev r bits f. c = cap.UntypedCap dev r bits f)) cref s \<and> (\<forall>x\<in>set slots. invs s \<and> real_cte_at x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s)\<rbrace>
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and ?Q32 rv) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'590 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>rv s. cte_wp_at (\<lambda>a. \<exists>dev r bits f. a = cap.UntypedCap dev r bits f) cref s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (\<exists>x. caps_of_state s cref = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> (\<exists>slot. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) slot s) \<and> (\<forall>x\<in>set slots. invs s \<and> cte_wp_at ((=) cap.NullCap) x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s) \<and> cte_wp_at (\<lambda>c. cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz \<and> (\<exists>dev r bits f. c = cap.UntypedCap dev r bits f)) cref s \<and> (\<forall>x\<in>set slots. invs s \<and> real_cte_at x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s)\<rbrace>
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and (\<lambda>a. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> distinct slots \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and caps_no_overlap ptr sz) a \<and> cref \<notin> set slots \<and> valid_etcbs a \<and> valid_list a \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> ?P'590 rv a)) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P596 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>rv. cte_wp_at (\<lambda>a. \<exists>dev r bits f. a = cap.UntypedCap dev r bits f) cref\<rbrace>
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'595 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>rv s. caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (\<exists>x. caps_of_state s cref = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> (\<exists>slot. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) slot s) \<and> (\<forall>x\<in>set slots. invs s \<and> cte_wp_at ((=) cap.NullCap) x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s) \<and> cte_wp_at (\<lambda>c. cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz \<and> (\<exists>dev r bits f. c = cap.UntypedCap dev r bits f)) cref s \<and> (\<forall>x\<in>set slots. invs s \<and> real_cte_at x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s)\<rbrace>
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and (\<lambda>a. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> distinct slots \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and caps_no_overlap ptr sz) a \<and> cref \<notin> set slots \<and> valid_etcbs a \<and> valid_list a \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> ?P596 rv a \<and> ?P'595 rv a)) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>rv s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; cte_wp_at (\<lambda>c. c = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>a. \<exists>dev r bits f. a = cap.UntypedCap dev r bits f) cref s
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'595 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>rv s. caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (\<exists>x. caps_of_state s cref = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> (\<exists>slot. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) slot s) \<and> (\<forall>x\<in>set slots. invs s \<and> cte_wp_at ((=) cap.NullCap) x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s) \<and> cte_wp_at (\<lambda>c. cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz \<and> (\<exists>dev r bits f. c = cap.UntypedCap dev r bits f)) cref s \<and> (\<forall>x\<in>set slots. invs s \<and> real_cte_at x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s)\<rbrace>
 3. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and (\<lambda>a. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> distinct slots \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and caps_no_overlap ptr sz) a \<and> cref \<notin> set slots \<and> valid_etcbs a \<and> valid_list a \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> True \<and> ?P'595 rv a)) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'595 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))\<rbrace> set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>rv s. caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (\<exists>x. caps_of_state s cref = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> (\<exists>slot. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) slot s) \<and> (\<forall>x\<in>set slots. invs s \<and> cte_wp_at ((=) cap.NullCap) x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s) \<and> cte_wp_at (\<lambda>c. cap_bits c = sz \<and> obj_ref_of c = ptr && ~~ mask sz \<and> (\<exists>dev r bits f. c = cap.UntypedCap dev r bits f)) cref s \<and> (\<forall>x\<in>set slots. invs s \<and> real_cte_at x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s)\<rbrace>
 2. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'35\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>a. (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) and (\<lambda>b. (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x b \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx313 cap a)) (cte_map cref) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> caps_no_overlap'' ptr sz b \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> ksCurDomain b \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of b)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> pspace_no_overlap' ptr sz b \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots)\<rbrace>
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and (\<lambda>a. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> distinct slots \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and caps_no_overlap ptr sz) a \<and> cref \<notin> set slots \<and> valid_etcbs a \<and> valid_list a \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> True \<and> ?P'595 rv a)) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and ?Q'35) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); cap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'678\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>rv s. pspace_no_overlap' ptr sz s \<and> (valid_pspace' s \<and> valid_arch_state' s \<and> range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> 0 < length slots) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> length slots \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> ptr \<noteq> 0) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x s \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> length slots \<noteq> 0 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 cap rv)) (cte_map cref) s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> distinct (cte_map cref # map cte_map slots) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> caps_no_overlap'' ptr sz s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} s \<and> ksCurDomain s \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> caps_no_overlap'' ptr sz s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} s \<and> ksCurDomain s \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> caps_no_overlap'' ptr sz s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} s \<and> ksCurDomain s \<le> maxDomain) \<and> (length slots \<noteq> 0 \<and> ptr \<noteq> 0 \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> caps_no_overlap'' ptr sz s \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} s \<and> ksCurDomain s \<le> maxDomain) \<and> ((range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} (cte_map cref) (ctes_of s)) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits ao' us - 1} s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots)) \<and> range_cover ptr sz (APIType_capBits ao' us) (length slots) \<and> 0 < length slots\<rbrace>
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and (\<lambda>a. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> distinct slots \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and caps_no_overlap ptr sz) a \<and> cref \<notin> set slots \<and> valid_etcbs a \<and> valid_list a \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> True \<and> (invs a \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref a \<and> cte_wp_at ((=) rv) cref a) \<and> (cte_wp_at (\<lambda>c. cap_range c = cap_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref) a \<and> (\<exists>x. ((caps_of_state a)(cref \<mapsto> cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> ((\<lambda>s. if cref = cref then cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) else cte_wp_at (\<lambda>a. cap_is_device a = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range a) cref s) and cte_wp_at (\<lambda>_. True) cref) a \<and> (\<forall>x\<in>set slots. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> ((\<lambda>s. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) and cte_wp_at (\<lambda>_. True) cref) a \<and> pspace_no_overlap (up_aligned_area ptr sz) a) \<and> ((\<lambda>s. if cref = cref then cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = sz \<and> obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = ptr && ~~ mask sz \<and> (\<exists>deva r bits f. cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) = cap.UntypedCap deva r bits f) else cte_wp_at (\<lambda>a. cap_bits a = sz \<and> obj_ref_of a = ptr && ~~ mask sz \<and> (\<exists>dev r bits f. a = cap.UntypedCap dev r bits f)) cref s) and cte_wp_at (\<lambda>_. True) cref) a \<and> (\<forall>x\<in>set slots. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> real_cte_at x a \<and> pspace_no_overlap (up_aligned_area ptr sz) a))) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> ?P'678 s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'678\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>rv s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_pspace' s \<and> pspace_no_overlap' ptr sz s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map x) s) \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s\<rbrace>
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and (\<lambda>a. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> distinct slots \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and caps_no_overlap ptr sz) a \<and> cref \<notin> set slots \<and> valid_etcbs a \<and> valid_list a \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> True \<and> (invs a \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref a \<and> cte_wp_at ((=) rv) cref a) \<and> (cte_wp_at (\<lambda>c. cap_range c = cap_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref) a \<and> (\<exists>x. ((caps_of_state a)(cref \<mapsto> cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> ((\<lambda>s. if cref = cref then cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) else cte_wp_at (\<lambda>a. cap_is_device a = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range a) cref s) and cte_wp_at (\<lambda>_. True) cref) a \<and> (\<forall>x\<in>set slots. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> ((\<lambda>s. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) and cte_wp_at (\<lambda>_. True) cref) a \<and> pspace_no_overlap (up_aligned_area ptr sz) a) \<and> ((\<lambda>s. if cref = cref then cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = sz \<and> obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = ptr && ~~ mask sz \<and> (\<exists>deva r bits f. cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) = cap.UntypedCap deva r bits f) else cte_wp_at (\<lambda>a. cap_bits a = sz \<and> obj_ref_of a = ptr && ~~ mask sz \<and> (\<exists>dev r bits f. a = cap.UntypedCap dev r bits f)) cref s) and cte_wp_at (\<lambda>_. True) cref) a \<and> (\<forall>x\<in>set slots. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> real_cte_at x a \<and> pspace_no_overlap (up_aligned_area ptr sz) a))) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> ?P'678 s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'678\<rbrace> updateFreeIndex (cte_map cref) (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<lbrace>\<lambda>r s. invs' s \<and> pspace_no_overlap' ptr sz s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map x) s) \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s\<rbrace>
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and (\<lambda>a. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> distinct slots \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and caps_no_overlap ptr sz) a \<and> cref \<notin> set slots \<and> valid_etcbs a \<and> valid_list a \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> True \<and> (invs a \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref a \<and> cte_wp_at ((=) rv) cref a) \<and> (cte_wp_at (\<lambda>c. cap_range c = cap_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref) a \<and> (\<exists>x. ((caps_of_state a)(cref \<mapsto> cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> ((\<lambda>s. if cref = cref then cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) else cte_wp_at (\<lambda>a. cap_is_device a = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range a) cref s) and cte_wp_at (\<lambda>_. True) cref) a \<and> (\<forall>x\<in>set slots. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> ((\<lambda>s. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) and cte_wp_at (\<lambda>_. True) cref) a \<and> pspace_no_overlap (up_aligned_area ptr sz) a) \<and> ((\<lambda>s. if cref = cref then cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = sz \<and> obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = ptr && ~~ mask sz \<and> (\<exists>deva r bits f. cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) = cap.UntypedCap deva r bits f) else cte_wp_at (\<lambda>a. cap_bits a = sz \<and> obj_ref_of a = ptr && ~~ mask sz \<and> (\<exists>dev r bits f. a = cap.UntypedCap dev r bits f)) cref s) and cte_wp_at (\<lambda>_. True) cref) a \<and> (\<forall>x\<in>set slots. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> real_cte_at x a \<and> pspace_no_overlap (up_aligned_area ptr sz) a))) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> ?P'678 s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. \<exists>rv. ((\<lambda>s. \<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s \<and> valid_objs s \<and> pspace_aligned s) and (cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_bits c = cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of rv) (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and valid_objs and pspace_aligned and pspace_distinct and (\<lambda>a. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> distinct slots \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and caps_no_overlap ptr sz) a \<and> cref \<notin> set slots \<and> valid_etcbs a \<and> valid_list a \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> pspace_no_overlap (up_aligned_area ptr sz) a \<and> True \<and> (invs a \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref a \<and> cte_wp_at ((=) rv) cref a) \<and> (cte_wp_at (\<lambda>c. cap_range c = cap_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref and descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref) a \<and> (\<exists>x. ((caps_of_state a)(cref \<mapsto> cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref = Some x \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> ((\<lambda>s. if cref = cref then cap_is_device (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) else cte_wp_at (\<lambda>a. cap_is_device a = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range a) cref s) and cte_wp_at (\<lambda>_. True) cref) a \<and> (\<forall>x\<in>set slots. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> ((\<lambda>s. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) and cte_wp_at (\<lambda>_. True) cref) a \<and> pspace_no_overlap (up_aligned_area ptr sz) a) \<and> ((\<lambda>s. if cref = cref then cap_bits (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = sz \<and> obj_ref_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) = ptr && ~~ mask sz \<and> (\<exists>deva r bits f. cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) = cap.UntypedCap deva r bits f) else cte_wp_at (\<lambda>a. cap_bits a = sz \<and> obj_ref_of a = ptr && ~~ mask sz \<and> (\<exists>dev r bits f. a = cap.UntypedCap dev r bits f)) cref s) and cte_wp_at (\<lambda>_. True) cref) a \<and> (\<forall>x\<in>set slots. ((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs a \<and> cte_wp_at ((=) rv) cref a) \<and> real_cte_at x a \<and> pspace_no_overlap (up_aligned_area ptr sz) a))) and (\<lambda>s. rv = cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (rv, s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. (\<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s) \<and> valid_objs s \<and> pspace_aligned s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = ptr && ~~ mask sz \<and> cap_bits c = bits_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<and> cap_is_device c = dev) cref s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> distinct slots \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> caps_no_overlap ptr sz s \<and> cref \<notin> set slots \<and> valid_etcbs s \<and> valid_list s \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> cte_wp_at (\<lambda>c. cap_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> up_aligned_area ptr sz \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> cte_wp_at (\<lambda>_. True) cref s \<and> (\<forall>x\<in>set slots. (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> (if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s) \<and> cte_wp_at (\<lambda>_. True) cref s \<and> (\<forall>x\<in>set slots. (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> real_cte_at x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s) \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>x s. pspace_aligned s \<and> pspace_distinct s \<and> invs s \<and> valid_objs s \<and> distinct slots \<and> caps_no_overlap ptr sz s \<and> cref \<notin> set slots \<and> cte_wp_at (\<lambda>_. True) cref s \<and> valid_etcbs s \<and> valid_list s \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s) \<and> cte_wp_at (\<lambda>c. cap_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr && ~~ mask sz \<and> cap_bits c = bits_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> up_aligned_area ptr sz \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> (\<forall>x\<in>set slots. invs s \<and> real_cte_at x s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz) \<and> (\<forall>x\<in>set slots. invs s \<and> cte_wp_at (\<lambda>_. True) cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>r s. invs s \<and> invs s \<and> invs s \<and> invs s \<and> distinct slots \<and> caps_no_overlap ptr sz s \<and> cref \<notin> set slots \<and> cte_wp_at (\<lambda>_. True) cref s \<and> valid_etcbs s \<and> valid_list s \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s) \<and> cte_wp_at (\<lambda>c. cap_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr && ~~ mask sz \<and> cap_bits c = bits_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> up_aligned_area ptr sz \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> (\<forall>x\<in>set slots. invs s \<and> real_cte_at x s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz) \<and> (\<forall>x\<in>set slots. invs s \<and> cte_wp_at (\<lambda>_. True) cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s))\<rbrace>, \<lbrace>\<lambda>r s. True\<rbrace>
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>r s. invs s \<and> distinct slots \<and> caps_no_overlap ptr sz s \<and> cref \<notin> set slots \<and> cte_wp_at (\<lambda>_. True) cref s \<and> valid_etcbs s \<and> valid_list s \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (\<forall>x\<in>set slots. real_cte_at x s) \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s) \<and> cte_wp_at (\<lambda>c. cap_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr && ~~ mask sz \<and> cap_bits c = bits_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> up_aligned_area ptr sz \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}\<rbrace>, \<lbrace>\<lambda>r s. True\<rbrace>
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> whenE reset (reset_untyped_cap cref) \<lbrace>\<lambda>_ s. valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace>, -
 2. \<And>rv s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> invs s \<and> distinct slots \<and> caps_no_overlap ptr sz s \<and> cref \<notin> set slots \<and> cte_wp_at (\<lambda>_. True) cref s \<and> valid_etcbs s \<and> valid_list s \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (\<forall>x\<in>set slots. real_cte_at x s) \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s) \<and> cte_wp_at (\<lambda>c. cap_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr && ~~ mask sz \<and> cap_bits c = bits_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> up_aligned_area ptr sz \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and ?Q7) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; reset\<rbrakk> \<Longrightarrow> \<lbrace>?P'774\<rbrace> reset_untyped_cap cref \<lbrace>\<lambda>rv s. invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace>, -
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; \<not> reset\<rbrakk> \<Longrightarrow> \<lbrace>?R771\<rbrace> returnOk () \<lbrace>\<lambda>_ s. valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace>, -
 3. \<And>rv s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> invs s \<and> distinct slots \<and> caps_no_overlap ptr sz s \<and> cref \<notin> set slots \<and> cte_wp_at (\<lambda>_. True) cref s \<and> valid_etcbs s \<and> valid_list s \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (\<forall>x\<in>set slots. real_cte_at x s) \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s) \<and> cte_wp_at (\<lambda>c. cap_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr && ~~ mask sz \<and> cap_bits c = bits_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> up_aligned_area ptr sz \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> ?P'774 s) \<and> (\<not> reset \<longrightarrow> ?R771 s))) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; \<not> reset\<rbrakk> \<Longrightarrow> \<lbrace>?R771\<rbrace> returnOk () \<lbrace>\<lambda>_ s. valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrace>, -
 2. \<And>rv s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> invs s \<and> distinct slots \<and> caps_no_overlap ptr sz s \<and> cref \<notin> set slots \<and> cte_wp_at (\<lambda>_. True) cref s \<and> valid_etcbs s \<and> valid_list s \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (\<forall>x\<in>set slots. real_cte_at x s) \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s) \<and> cte_wp_at (\<lambda>c. cap_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr && ~~ mask sz \<and> cap_bits c = bits_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> up_aligned_area ptr sz \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> ?R771 s))) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>rv s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\<rbrakk> \<Longrightarrow> invs s \<and> distinct slots \<and> caps_no_overlap ptr sz s \<and> cref \<notin> set slots \<and> cte_wp_at (\<lambda>_. True) cref s \<and> valid_etcbs s \<and> valid_list s \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (\<forall>x\<in>set slots. real_cte_at x s) \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref. cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) cref s) \<and> cte_wp_at (\<lambda>c. cap_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))))) cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_is_device c = dev \<and> obj_ref_of c = ptr && ~~ mask sz \<and> cap_bits c = bits_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> up_aligned_area ptr sz \<subseteq> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref cap. caps_of_state s cref = Some cap \<and> is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> up_aligned_area ptr sz \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> cap_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}\<rbrakk> \<Longrightarrow> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref cap. caps_of_state s cref = Some cap \<and> is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> up_aligned_area ptr sz \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}\<rbrakk> \<Longrightarrow> dev = ?dev820 s \<and> ptr && ~~ mask sz = ?ptr_base820 s \<and> sz = ?sz820 s \<and> (if reset then 0 else idx) = ?idx820 s \<and> ?ptr820 s && ~~ mask (?sz820 s) = ?ptr_base820 s \<and> range_cover (?ptr820 s) (?sz820 s) (obj_bits_api (?tp820 s) (?us820 s)) (length (?slots820 s)) \<and> (?idx820 s \<le> unat (?ptr820 s - ?ptr_base820 s) \<or> reset \<and> ?ptr820 s = ?ptr_base820 s) \<and> ?ptr820 s && ~~ mask (?sz820 s) = ?ptr_base820 s \<and> (?tp820 s = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < ?us820 s) \<and> (?tp820 s = Structures_A.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> ?us820 s) \<and> cref \<notin> set (?slots820 s) \<and> distinct (?slots820 s) \<and> (\<forall>slot\<in>set (?slots820 s). caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> ?tp820 s \<noteq> ArchObject ASIDPoolObj \<and> ?slots820 s \<noteq> [] \<and> (?dev820 s \<longrightarrow> ?tp820 s = Structures_A.apiobject_type.Untyped \<or> is_frame_type (?tp820 s))
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (?ptr_base820 s) (?ptr820 s) (?tp820 s) (?us820 s) (?slots820 s) (?sz820 s) (?idx820 s) (?dev820 s)\<rbrakk> \<Longrightarrow> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref cap. caps_of_state s cref = Some cap \<and> is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> up_aligned_area ptr sz \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}\<rbrakk> \<Longrightarrow> ((if reset then 0 else idx) \<le> unat (ptr - (ptr && ~~ mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz) \<and> ptr && ~~ mask sz = ptr && ~~ mask sz \<and> (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (APIType_map2 (Inr ao') = Structures_A.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> cref \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> APIType_map2 (Inr ao') = Structures_A.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref cap. caps_of_state s cref = Some cap \<and> is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> up_aligned_area ptr sz \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} cref s \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref cap. caps_of_state s cref = Some cap \<and> is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> up_aligned_area ptr sz \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> (if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cref cap. caps_of_state s cref = Some cap \<and> is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> up_aligned_area ptr sz \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> ((reset \<longrightarrow> 0 \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz))) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<exists>cap. caps_of_state s cref = Some cap \<and> is_untyped_cap cap \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range cap) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> up_aligned_area ptr sz \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ LENGTH(32); length slots < 2 ^ (LENGTH(32) - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap (up_aligned_area ptr sz) s\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx), s) \<in> fst (get_cap cref s) \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; \<not> reset\<rbrakk> \<Longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us))
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; \<not> reset\<rbrakk> \<Longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us))
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; \<not> reset; (if reset then 0 else idx) \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us))\<rbrakk> \<Longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us))
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 5. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> {x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1} \<subseteq> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 4. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 3. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr (APIType_map2 (Inr ao')) us slots sz (if reset then 0 else idx) dev; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 4294967296; length slots < 2 ^ (32 - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_etcbs s; valid_list s; invs s; ct_active s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> descendants_of cref (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; global_refs s \<inter> untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}; sz < word_bits; pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api (APIType_map2 (Inr ao')) us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> whenE reset (resetUntypedCap (cte_map cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and ?Q'7) s proof (prove)
goal (4 subgoals):
 1. \<And>rv s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) and ct_active' and pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)) s
 2. \<And>e s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s\<rbrakk> \<Longrightarrow> True
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (4 subgoals):
 1. \<And>e s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s\<rbrakk> \<Longrightarrow> True
 2. \<And>rv s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) and ct_active' and pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)) s
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (3 subgoals):
 1. \<And>rv s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) and ct_active' and pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1) \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map cref) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s) \<and> (pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> ksCurDomain s \<le> maxDomain \<and> (caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s) \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.NullCap) (cte_map x) s) \<and> (valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cte_map cref = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s)) s)) s
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map cref) s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap c) = capability.NullCap) (cte_map x) s) \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) (cteCap c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map cref) s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap c) = capability.NullCap) (cte_map x) s) \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) (cteCap c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1); invokeUntyped_proofs s (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map cref) s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits) \<circ> cteCap) (cte_map cref) s \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> cte_map cref \<notin> cte_map ` set slots \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap c) = capability.NullCap) (cte_map x) s) \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map cref) s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map cref) s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) (cteCap c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ())) (cte_map cref) s
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> (\<not> reset \<longrightarrow> idx \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ sz \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> (\<forall>x\<in>set slots. \<exists>cte. ctes_of s (cte_map x) = Some cte \<and> (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap cte) = capability.NullCap) \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) = ?idx669 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) ()
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> (\<not> reset \<longrightarrow> idx \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ sz \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> (\<forall>x\<in>set slots. \<exists>cte. ctes_of s (cte_map x) = Some cte \<and> (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap cte) = capability.NullCap) \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> True
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> (if reset then 0 else idx) \<le> unat ((ptr && mask sz) + word_of_nat (length (map cte_map slots)) * 2 ^ APIType_capBits ao' us)\<rbrakk> \<Longrightarrow> (\<not> reset \<longrightarrow> idx \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ sz \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> (\<forall>x\<in>set slots. \<exists>cte. ctes_of s (cte_map x) = Some cte \<and> (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap cte) = capability.NullCap) \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> True
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> (if reset then 0 else idx) \<le> unat ((ptr && mask sz) + word_of_nat (length (map cte_map slots)) * 2 ^ APIType_capBits ao' us); sz < word_bits\<rbrakk> \<Longrightarrow> (\<not> reset \<longrightarrow> idx \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ sz \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> (\<forall>x\<in>set slots. \<exists>cte. ctes_of s (cte_map x) = Some cte \<and> (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap cte) = capability.NullCap) \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {} \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s) \<and> True
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)) - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> (\<not> reset \<longrightarrow> idx \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))) \<le> 2 ^ sz \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) minUntypedSizeBits \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> (\<forall>x\<in>set slots. \<exists>cte. ctes_of s (cte_map x) = Some cte \<and> (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap cte) = capability.NullCap) \<and> valid_pspace' s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us))))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s \<and> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) \<le> 2 ^ sz \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set slots. \<exists>cte. ctes_of s (cte_map x) = Some cte \<and> (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap cte) = capability.NullCap) \<and> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (7 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 2. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) \<le> 2 ^ sz
 3. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. \<exists>cte. ctes_of s (cte_map x) = Some cte \<and> (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap cte) = capability.NullCap
 5. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (7 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 2. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) \<le> 2 ^ sz
 3. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. \<exists>cte. ctes_of s (cte_map x) = Some cte \<and> (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap cte) = capability.NullCap
 5. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 6. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 7. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (6 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) \<le> 2 ^ sz
 2. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. \<exists>cte. ctes_of s (cte_map x) = Some cte \<and> (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap cte) = capability.NullCap
 4. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (6 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us) \<le> unat ((ptr && mask sz) + (word_of_nat (length (map cte_map slots)) << APIType_capBits ao' us))
 2. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. \<exists>cte. ctes_of s (cte_map x) = Some cte \<and> (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap cte) = capability.NullCap
 4. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 5. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 6. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (5 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. \<exists>cte. ctes_of s (cte_map x) = Some cte \<and> (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap cte) = capability.NullCap
 3. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 4. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 5. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (4 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. \<exists>cte. ctes_of s (cte_map x) = Some cte \<and> (if cte_map x = cte_map cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (obj_bits_api (APIType_map2 (Inr ao')) us)))) else id) (cteCap cte) = capability.NullCap
 2. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 3. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 4. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; invs' s; ct_active' s; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1); invokeUntyped_proofs s (cte_map cref) reset (ptr && ~~ mask sz) ptr ao' us (map cte_map slots) sz (if reset then 0 else idx) dev; range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); ctes_of s (cte_map cref) = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' (cte_map cref) (ctes_of s) = {}; cte_map cref \<notin> cte_map ` set slots; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s (cte_map slot) = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; obj_bits_api (APIType_map2 (Inr ao')) us \<le> maxUntypedSizeBits; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} (cte_map cref) (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1} = {}
 2. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 3. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s = sa; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev16)) s) and (\<lambda>s. (reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_A.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> valid_list s \<and> invs s \<and> ct_active s \<and> valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)))) sa
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> (((True \<and> valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) s) \<and> True) \<and> (True \<and> True) \<and> True) \<and> (\<exists>ptr_basea ptr' ty usa slotsa dev'. Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev = Invocations_A.untyped_invocation.Retype cref True ptr_basea ptr' ty usa slotsa ?dev16)) \<and> (reset \<longrightarrow> valid_etcbs s \<and> True \<and> ((True \<and> valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx784)) s) \<and> True) \<and> K (\<exists>ptr_basea ptr' ty usa slotsa. Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev = Invocations_A.untyped_invocation.Retype cref True ptr_basea ptr' ty usa slotsa dev) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> True \<and> True \<and> True \<and> valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s))
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap ?dev16 ?ptr16 ?sz16 ?idx16)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> (((True \<and> True) \<and> True) \<and> (True \<and> True) \<and> True) \<and> (\<exists>ptr_basea ptr' ty usa slotsa dev'. Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev = Invocations_A.untyped_invocation.Retype cref True ptr_basea ptr' ty usa slotsa dev)) \<and> (reset \<longrightarrow> valid_etcbs s \<and> True \<and> ((True \<and> True) \<and> True) \<and> K (\<exists>ptr_basea ptr' ty usa slotsa. Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev = Invocations_A.untyped_invocation.Retype cref True ptr_basea ptr' ty usa slotsa dev) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> True \<and> True \<and> True \<and> valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s))
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s; invs s; ct_active s; valid_list s; valid_sched s; invs' s'; ct_active' s'\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> (((True \<and> True) \<and> True) \<and> (True \<and> True) \<and> True) \<and> (\<exists>ptr_basea ptr' ty usa slotsa dev'. Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev = Invocations_A.untyped_invocation.Retype cref True ptr_basea ptr' ty usa slotsa dev)) \<and> (reset \<longrightarrow> valid_etcbs s \<and> True \<and> ((True \<and> True) \<and> True) \<and> K (\<exists>ptr_basea ptr' ty usa slotsa. Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev = Invocations_A.untyped_invocation.Retype cref True ptr_basea ptr' ty usa slotsa dev) s) \<and> (\<not> reset \<longrightarrow> valid_etcbs s \<and> True \<and> True \<and> True \<and> valid_untyped_inv_wcap (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s))
 2. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); s' = s; length slots < 2 ^ word_bits; length slots < 2 ^ (word_bits - obj_bits_api (APIType_map2 (Inr ao')) us); slots \<noteq> []; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz') sz' idx')) s'; invs' s'; ct_active' s'\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active') s) and (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_base ty us slots. ui' = Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ty us slots dev))) s proof (prove)
goal:
No subgoals! proof (state)
this:
corres (dc \<oplus> (=)) ((=) s) ((=) s') (invoke_untyped (Invocations_A.untyped_invocation.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev)) (invokeUntyped (Invocations_H.untyped_invocation.Retype (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) dev))

goal:
No subgoals!